Unmasking Hidden Threats: How to Conduct a Comprehensive Security Risk Assessment