COSSAC: a framework for analyzing and configuring secure computer facilities. - John M. Carroll 002; W. R. Mac Iver (Comput. Secur., 1985)