Models for Security Assessment and Management