1. In a distributed computing system environment that includes a plurality of computing devices that each comprise a processor and system memory, a method of transmitting a secure message from a first party to a second party, the first party using a first cryptographic technology and the second party using a second cryptographic technology, wherein the first and second parties are within a generic security framework and wherein the generic security framework abstracts cryptographic technologies and license formats, the method comprising: determining that a message is to be sent to the second party; a processor creating at least one security credential using a modular security policy and creating an encrypted message from the message, wherein the modular security policy: establishes security rules and procedures of the generic security framework; implements a security policy of the generic security framework with one or more protocols and transports; and describes security aspects, including properties, capabilities, requirements and interaction semantics, of a plurality of modular security components which define behaviors corresponding to the first and second cryptographic technologies used by the first and second parties, and which are written in a security policy language as selectable, deployable and combinable security modules and which enables the security components to be negotiated, partitioned and modified, and rather than being hard-coded, and which include: a store component for storing, retrieving, encrypting, and managing credentials; an integrity component for signing portions of a message and for verifying integrity and signatures of received messages; and a confidentiality component for encrypting and decrypting portions of a message; and formatting a second message with a markup language wherein the markup language comprises at least one header and wherein the second message contains the encrypted message; inserting at least the one security credential into the at least one header in the markup language in the second message; and transmitting the second message to the second party and wherein the second party can use the modular security policy to decrypt and verify the message.