VALUING INVESTMENT IN CYBER SECURITY