Why Do I get this "Object reference not set to an instance of an object"

public string CreateAuthenticationToken(string strEncryptedUserName,
string strEncryptedPassword)
{
//Microsoft.Web.Services3.Security.Tokens.UsernameToken
userToken = new
Microsoft.Web.Services3.Security.Tokens.UsernameToken(strEncryptedUserName,
strEncryptedPassword, PasswordOption.SendHashed);
UsernameToken objUserToken = new UsernameToken("admin",
"admin");
Security security = null;

try
{
*****************I am getting on this line, Don't why
int strAuthToekn = security.Tokens.Add(objUserToken);
}
catch (Exception strException)
{
throw (strException);
return strException.Message;
}
}

.