Towards automatic reverse engineering of software security configurations