Text this: Adopting and Adapting Medical Approach in Risk Management Process for Analysing Information Security Risk