An Approach to Security Policy Configuration Using Semantic Threat Graphs