Methods on Determining the Investment in IT Security