Systems Modelling for Economic Analyses of Security Investments: A Case Study in Identity and Access Management