Quantitative Metrics And Measurement Methodologies For System Security Assurance