An optimization framework for prioritizing mitigations for securing information technology infrastructure