A hybrid information security risk assessment procedure considering interdependences between controls · Study