Secure tropos: a security-oriented extension of the tropos methodology