How do you design security requirements for a high-availability system or large-scale data processing platform?