Thirty years later: Lessons from the Multics security evaluationPaul A. KargerRoger R. Schell2002ACSAC 2002
