Quantitative models for supply chain risk analysis from a firm’s perspective