What type of risk management strategy is Melanie pursuing in the case that she recently completed a risk assessment where she rated the risk of a DDoS attack as a serious threat and she is considering purchasing a DDoS protection service?