A security metric catalogue for cloud applications