The core problem in risk analysis - determining exploitable paths between attackers and system assets is essentially a problem of determining information flow. It is relatively straightforward to interpret design models for service-based distributed systems in information-flow terms, but the analysis results must be integrated into the system engineering process, and any resulting security controls must be meaningful to system practitioners as well as security analysts. The work reported here addresses these practical problems; it shows that information flow analysis can be integrated into the requirements traceability process, ensuring that security controls are specific about the properties they require. Communication between information-analyst and system practitioner is also addressed by tuning the analysis to reflect the exploitability of threat paths, and by defining security controls as patterns of information-flow constraints, rather than single predicates.