A Relationship between Security Engineering and Security Evaluation