But attacking the problem requires a strategy appropriate to the organization involved and its particular risks , including a consideration of the legal requirements surrounding security and privacy issues .
The same attacking strategy can be used for all organizations .