Modeling security as a dependability attribute: a refinement-based approach