working_paper_security_policy_9_2015.pdf