working_paper_security_policy_12_2015