How integrating physical and information security mitigates risks