Managing Information Risks: Threats, Vulnerabilities, and Responses