Wes Sonnenreich Jason Albanese Bruce Stout Return On Security Investment (ROSI): A Practical Quantitative Model. 239-252 2005 conf/sis/2005 WOSIS db/conf/sis/wosis2005.html#SonnenreichAS05