Wendy Nather and Wade Baker have a few data-driven ideas about which activities actually help to make security programs work and which ones have less impact