5 Characteristics of Effective Security Metrics