2.

Given terminology:

Managing Security is equal to managing risk

First, we have to define security and risk management

Security management

It is the protection of an organization's asset by implementing security policies. Identify the

assets of an organization including data, people, machine and tools. All the assets are
protected by some security policies.

Risk management

In terms of security, risk is the external or internal issues for implementing security in assets.
It can be strategic, operational, hazards and financial risks.

Security and risk are relating to each other, for implementing security, there is a chance of
risk. So, managing security is equal to managing risk.

Steps for security risk management

It emphasizes on management of risks in security applies the principles of risk management

to the management of security threats.

1. Identifying risk causes: Identify the cause of risk involved in the implementation of security. 
2. Existing control assessment: Identify the control measure to avoid risk. Risk avoidance
includes the chance of removing the existence of criminal opportunity or avoiding the
creation of such an opportunity. 
3. Determining the risks' consequences: Identify the after effects of risk.
4. Prioritizing the risks by rating the likelihood and impact: Identified risks are categorized and
give priority to risk that have major threats to the asset.
5. Classifying the type of risk: It can be compliance, strategic, operational, hazards and
financial risks.
6. Selecting an appropriate risk option or risk response: The risk options are:
  Risk reduction: Reduce the chance for risk threats.
 Risk avoidance: Eliminating the opportunity of risks.
 Risk transfer: Implement for insuring the assets or increase costs to cover the loss in the
event of a criminal act
 Risk spreading: For removing spread of risk, reduce the  time to access assets.
 Risk acceptance: Accept the risk of assets which are coverable or which have insurance
coverage.

So, for implementing security to assets, we have to implement the risk management. Hence
Managing Security is equal to managing risk.