a systematic approach to significant risk reduction in the imperfect, real world of commercial off-the-shelf systems and changing threats