An Ontology-based Approach to the Formalization of Information Security Policies