Extensible threat taxonomy for critical infrastructures