Assessing Security Risk to a Network Using a Statistical Model of Attacker Community Competence