A process model for implementing information systems security governance
Correlated failures, diversification, and information security risk management