Section 5.3.3, the security patterns they are considering are those that
describe software security functionality, so it is likely that the metrics the
team defines will measure effectiveness of those security functions in
terms of policy enforcement orintrusion/compromise prevention.