How public authorities should deal with security risks