Allocating Resources Appropriately for Data Breach Prevention