Configuring Security Requirements for Administrators and Users