A practical guide to security risk assessments: what they are, a seven-step process, how to score and prioritise risks, and the mistakes that make most of them useless.