From modeling to managing security