Managing security sources doc

@lukebakken Ready for initial review.