Three Essays On Information Security Risk Management