Describir: Information Security Practice and Experience