Farming Out Security: How to Choose a Service Provider