Defining security objectives