Specifying a security policy: a case study | IEEE Conference Publication | IEEE Xplore