Operational Security Risk Metrics: Definitions