An Experimental Comparison of Two Risk-Based Security Methods