Security Assurance By Design