John Leach: Security engineering and security RoI. Comput. Secur. 22(6): 482-486 (2003)