Understanding Security Risks: Methodologies for Assessing and Controlling Them