A method for representing security features of a distributed system is presented. The method includes creating abstractions to describe security mechanisms of a system, and creating a specification using the abstractions. The specification models components of the security mechanisms, features of an environment in which the system operates, and supporting security features. The method may further include linking the specification to graphical representations, and using the specification to construct an instance diagram that graphically depicts the security features of the system and its operational environment. The specification or the instance diagram may be used to construct an instance model, which may be a textual rendering, that models the security features of the system and its operational environment. Where the specification is used to construct the instance model, the method may further include using the instance model to construct the instance diagram.