Risk Management for Computer Security by Andy Jones & Debi Ashenden