Enterprise Cyber Security: principles and practice