Metrics and Methods for Security Risk Management