Challenges in applying security games