Security by behavioural design: a feasibility study