Evaluation criteria for IT security -- Part 1: Introduction and general model