Information Security Risk Analysis and Advanced Persistent Threat: A Multiple Case Study