Analysing Security in Information Systems