Quantifying Cyber Risk by Integrating Attack Graph and Impact Graph