Normative cybersecurity