John M. Carroll, W. R. Mac Iver: COSSAC: a framework for analyzing and configuring secure computer facilities. Comput. Secur. 4(1): 5-12 (1985)