An Options Approach to Cybersecurity Investment