Security for industrial automation and control systems - Part 3-2: Security risk assessment for system design