Empirical Assessment of Security Requirements and Architecture: Lessons Learned