Why is it difficult to conduct a security cost-benefit justification for controls before an attack occurs?.