Value-based security risk assessment