Similar Items: A Scalable Game-Theoretic Approach for Selecting Security Controls from Standardized Catalogues