Optimal Spending on Cybersecurity Measures