Separation of responsibilities change management and thinking about security