Specifying security properties