A quantitative approach to risk management in Critical Infracstructures