philosophy of IT security