Understanding threats: a prerequisite to enhance survivability of computing systems