Assessing and Managing Security Risk in IT Systems