The first step in any cyber security activity is to define your risk appetite; and define the security controls (e.g. sudo) accordingly.

--

Arun Khan