Cyber risk measurement with ordinal data