https://dfarq.homeip.net/how-to-measure-the-effectiveness-of-a-security-program/