correctly handle case when no security attributes is specified