Risk Assessment of Information Technology Systems