Information Security Risk Assessment through Data Collection and Analysis