how do you write a background research paper it security risk assessment case study