Information Security Risk Assessment, Aggregation, and Mitigation. - Arjen K. Lenstra; Tim Voss (ACISP, 2004)