operating model design for security