Factor Analysis of Information Risk