VaR vs CVaR in Risk Management and Optimization