IT Security Tutorial - Risk assessments and risk scores