An Investor's Framework for Thinking About Cybersecurity