At which stage of risk analysis specification, the additional security requirements take account of the technologies used in building the system and system design and implementation decisions ?