At past DEF CON events, including DEF CON 101, most of the attendees we’ve encountered were either new to the field of security or had security functions in their job description on top of other job duties such as system administration or programming. The purpose of this talk, which is based on real world experiences, is to introduce a multi-year approach to methodologies, techniques, and tools that will allow someone who may be the sole security staff member for an organization to build an effective security program in a cost effective and resource constrained manner. If security is a process, this will provide a “Step 1” to getting that process started.