Intrusion Tolerance: Concepts and Design Principles