security threat model process controls audit oracle controls cpa software security automation buffer overflow general computing controls controls security program manager accounting firewall engineering smart card module software vulnerabilities exploit smart card deployment security conseil antivirus