Risk assessments and best security practices