Assessing ICT risk through a Monte Carlo method