Risk analysis for industrial IT security