Risk Management for Service-Oriented Systems