Application of cost-benefit analysis for the selection of process-industry related security measures