Fundamental security design principles paper