Are computing systems trustworthy? To answer this, we need to know three things: what the systems are supposed to do, what they are not supposed to do, and what they actually do. A...
This paper studies the problem of securing information release in dynamic languages. We propose (i) an intuitive framework for information-release policies expressing both what ca...
In this work we ask the question: what are the challenges of managing a physical or file system access-control policy for a large organization? To answer the question, we conducte...
Lujo Bauer, Lorrie Faith Cranor, Robert W. Reeder,...
Traditional security policies largely focus on access control requirements, which specify who can access what under what circumstances. Besides access control requirements, the av...
Abstract. An important goal of security in information systems is confidentiality. A confidentiality policy specifies which users should be forbidden to acquire what kind of inform...