security properties are often expressed in negative terms (i.e., what the software
must not do) it is particularly difficult to specify requirements for those
properties (formally or informally), and then to mathematically prove that
those requirements have been correctly satisfied in the implemented software.