required properties of the system, including security. This may make sense from
the point of view of a security certifier, who is only interested in the system’s
security; but it is not effective for specifying an overall system architecture
that can form the basis for a cohesive design with security deeply embedded.