working_paper_security_policy_10_2015.pdf