cyber-attack effect evaluation