The devil you know how idioms can relate to information security