diff --git a/common/rfb/CConnection.cxx b/common/rfb/CConnection.cxx
index 692fac4..ac3c35e 100644
--- a/common/rfb/CConnection.cxx
+++ b/common/rfb/CConnection.cxx
@@ -32,15 +32,16 @@
 static LogWriter vlog("CConnection");
 
 CConnection::CConnection()
-  : is(0), os(0), reader_(0), writer_(0),
-    shared(false), security(0), nSecTypes(0), clientSecTypeOrder(false),
+  : csecurity(0), is(0), os(0), reader_(0), writer_(0),
+    shared(false), nSecTypes(0), clientSecTypeOrder(false),
     state_(RFBSTATE_UNINITIALISED), useProtocol3_3(false)
 {
+  security = new Security();
 }
 
 CConnection::~CConnection()
 {
-  if (security) security->destroy();
+  if (csecurity) csecurity->destroy();
   deleteReaderAndWriter();
 }
 
@@ -196,14 +197,14 @@
   }
 
   state_ = RFBSTATE_SECURITY;
-  security = getCSecurity(secType);
+  csecurity = security->GetCSecurity(secType);
   processSecurityMsg();
 }
 
 void CConnection::processSecurityMsg()
 {
   vlog.debug("processing security message");
-  if (security->processMsg(this)) {
+  if (csecurity->processMsg(this)) {
     state_ = RFBSTATE_SECURITY_RESULT;
     processSecurityResultMsg();
   }
@@ -213,7 +214,7 @@
 {
   vlog.debug("processing security result message");
   int result;
-  if (cp.beforeVersion(3,8) && security->getType() == secTypeNone) {
+  if (cp.beforeVersion(3,8) && csecurity->getType() == secTypeNone) {
     result = secResultOK;
   } else {
     if (!is->checkNoWait(1)) return;
diff --git a/common/rfb/CConnection.h b/common/rfb/CConnection.h
index 79110eb..6d3783a 100644
--- a/common/rfb/CConnection.h
+++ b/common/rfb/CConnection.h
@@ -26,7 +26,9 @@
 #include <rdr/InStream.h>
 #include <rdr/OutStream.h>
 #include <rfb/CMsgHandler.h>
+#include <rfb/CSecurity.h>
 #include <rfb/util.h>
+#include <rfb/Security.h>
 
 namespace rfb {
 
@@ -96,15 +98,6 @@
 
     // Methods to be overridden in a derived class
 
-    // getCSecurity() gets the CSecurity object for the given type.  The type
-    // is guaranteed to be one of the secTypes passed in to addSecType().  The
-    // CSecurity object's destroy() method will be called by the CConnection
-    // from its destructor.
-    virtual CSecurity* getCSecurity(int secType)=0;
-
-    // getCurrentCSecurity() gets the CSecurity instance used for this connection.
-    const CSecurity* getCurrentCSecurity() const {return security;} 
-
     // getIdVerifier() returns the identity verifier associated with the connection.
     // Ownership of the IdentityVerifier is retained by the CConnection instance.
     virtual IdentityVerifier* getIdentityVerifier() {return 0;}
@@ -149,8 +142,10 @@
 
     stateEnum state() { return state_; }
 
+    CSecurity *csecurity; /* Windows viewer needs it exported. */
   protected:
     void setState(stateEnum s) { state_ = s; }
+    Security *security;
 
   private:
     void processVersionMsg();
@@ -168,7 +163,6 @@
     CMsgWriter* writer_;
     bool deleteStreamsWhenDone;
     bool shared;
-    CSecurity* security;
     enum { maxSecTypes = 8 };
     int nSecTypes;
     rdr::U8 secTypes[maxSecTypes];
diff --git a/common/rfb/Security.cxx b/common/rfb/Security.cxx
index daf3ac5..fac2d4b 100644
--- a/common/rfb/Security.cxx
+++ b/common/rfb/Security.cxx
@@ -39,7 +39,7 @@
 StringParameter Security::secTypes
 ("SecurityTypes",
  "Specify which security scheme to use (None, VncAuth)",
- "VncAuth");
+ "VncAuth", ConfServer);
 
 Security::Security(void) : upg(NULL)
 {
diff --git a/unix/vncviewer/CConn.cxx b/unix/vncviewer/CConn.cxx
index 8bbc621..556d058 100644
--- a/unix/vncviewer/CConn.cxx
+++ b/unix/vncviewer/CConn.cxx
@@ -71,6 +71,8 @@
   setShared(shared);
   addSecType(secTypeNone);
   addSecType(secTypeVncAuth);
+  security->upg = this; /* Security instance is created in CConnection costructor. */
+
   CharArray encStr(preferredEncoding.getData());
   int encNum = encodingNum(encStr.buf);
   if (encNum != -1) {
@@ -214,7 +216,7 @@
     return;
   }
 
-  const char* secType = secTypeName(getCurrentCSecurity()->getType());
+  const char* secType = secTypeName(csecurity->getType());
   const char* titlePrefix = _("VNC authentication");
   unsigned int titleLen = strlen(titlePrefix) + strlen(secType) + 4;
   CharArray title(titleLen);
@@ -229,19 +231,6 @@
 
 // CConnection callback methods
 
-// getCSecurity() gets the appropriate CSecurity object for the security
-// types which we support.
-CSecurity* CConn::getCSecurity(int secType) {
-  switch (secType) {
-  case secTypeNone:
-    return new CSecurityNone();
-  case secTypeVncAuth:
-    return new CSecurityVncAuth(this);
-  default:
-    throw rfb::Exception("Unsupported secType?");
-  }
-}
-
 // serverInit() is called when the serverInit message has been received.  At
 // this point we create the desktop window and display it.  We also tell the
 // server the pixel format and encodings to use and request the first update.
@@ -510,7 +499,7 @@
       char spfStr[100];
       cp.pf().print(pfStr, 100);
       serverPF.print(spfStr, 100);
-      int secType = getCurrentCSecurity()->getType();
+      int secType = csecurity->getType();
       char infoText[1024];
       snprintf(infoText, sizeof(infoText),
 	       _("Desktop name: %.80s\n"
diff --git a/unix/vncviewer/CConn.h b/unix/vncviewer/CConn.h
index 94fa18c..ac88963 100644
--- a/unix/vncviewer/CConn.h
+++ b/unix/vncviewer/CConn.h
@@ -72,7 +72,6 @@
   virtual void handleEvent(TXWindow* w, XEvent* ev);
   
   // CConnection callback methods
-  rfb::CSecurity* getCSecurity(int secType);
   void serverInit();
   void setDesktopSize(int w, int h);
   void setExtendedDesktopSize(int reason, int result, int w, int h,
diff --git a/win/vncviewer/CConn.cxx b/win/vncviewer/CConn.cxx
index 3d7f99a..97ef520 100644
--- a/win/vncviewer/CConn.cxx
+++ b/win/vncviewer/CConn.cxx
@@ -102,6 +102,7 @@
   // - Set which auth schemes we support, in order of preference
   addSecType(secTypeVncAuth);
   addSecType(secTypeNone);
+  security->upg = this; /* Security instance is created in CConnection costructor. */
 
   // Start the RFB protocol
   sock = s;
@@ -406,20 +407,6 @@
   }
 }
 
-
-CSecurity* CConn::getCSecurity(int secType)
-{
-  switch (secType) {
-  case secTypeNone:
-    return new CSecurityNone();
-  case secTypeVncAuth:
-    return new CSecurityVncAuth(this);
-  default:
-    throw Exception("Unsupported secType?");
-  }
-}
-
-
 void
 CConn::setColourMapEntries(int first, int count, U16* rgbs) {
   vlog.debug("setColourMapEntries: first=%d, count=%d", first, count);
@@ -817,7 +804,7 @@
   if ((user && !*user) || (password && !*password)) {
     // Missing username or password - prompt the user
     UserPasswdDialog userPasswdDialog;
-    userPasswdDialog.setCSecurity(getCurrentCSecurity());
+    userPasswdDialog.setCSecurity(csecurity);
     userPasswdDialog.getUserPasswd(user, password);
   }
   if (user) options.setUserName(*user);
diff --git a/win/vncviewer/InfoDialog.cxx b/win/vncviewer/InfoDialog.cxx
index 34644cd..551ccf2 100644
--- a/win/vncviewer/InfoDialog.cxx
+++ b/win/vncviewer/InfoDialog.cxx
@@ -59,7 +59,7 @@
   sprintf(buf, "%d.%d", conn->cp.majorVersion, conn->cp.minorVersion);
   setItemString(IDC_INFO_VERSION, TStr(buf));
 
-  const CSecurity* cSec = conn->getCurrentCSecurity();
+  const CSecurity* cSec = conn->csecurity;
   setItemString(IDC_INFO_SECURITY, TStr(secTypeName(cSec->getType())));
   setItemString(IDC_INFO_ENCRYPTION, TStr(cSec->description()));
 }