Information Security Metrics An Empirical Study of Current Practice