How Does Risk Affect Information Security