Information security monitoring and measurement