Visible to the public An optimization framework for prioritizing mitigations for securing information technology infrastructure