Security policy audits: why and how. (arXiv:2207.11306v1 [cs.CR])

Information security isn't just about software and hardware -- it's at least
as much about policies and processes. But the research community overwhelmingly
focuses on the former over the latter, while gaping policy and process problems
persist. In this experience paper, we describe a series of security policy
audits that we conducted, exposing policy flaws affecting billions of users
that can be -- and often are -- exploited by low-tech attackers who don't need
to use any tools or exploit …

audits policy security security policy