SECURITY METRICS AND EVALUATION OF INFORMATION SYSTEMS SECURITY