Risk thinking for cloud-based application services. (2017)