Empirical Computer Security