Security Knowledge from Practice