An application of qualitative risk analysis to computer security for the commercial sector. - S. P. Bennett; Muninder P. Kailay (ACSAC, 1992)