security operating model