know how life-cycle risk assessment and operational risk assessment are used to understand security issues that affect a system design;