category theory applied to computer security