Why Security Pros Should Rethink Their Focus on Information