Towards Operational Measures of Computer Security