Security metrics: What is a Metric?