Designing a framework for designing and implement security?