Three questions you should always be able to answer about your security environment