A startup is building a new social platform. What are the first three security controls you implement?