How to formulate a cyber security strategy