Underlying technical models for information technology security :: recommendations of the National Institute of Standards and Technology