Industrial control system cyber security risk high, report warns