Information Security Consulting Done Right