Evaluating Security Concepts