Performing Security Analyses of Information Systems