Security policy audits: why and how

Arvind Narayanan, Kevin Lee

Information security isn't just about software and hardware -- it's at least as much about policies and processes. But the research community overwhelmingly focuses on the former o…