Using CP-nets as a guide for countermeasure selection