How can organizational management measure the success of their network security? Please provide an example and three references