Security Policy Audits: Why and How
Arvind Narayanan, Kevin Lee · IEEE Security & Privacy · 2023
We describe a series of security policy audits that we conducted, exposing policy flaws affecting billions of users that are often exploited by even low-tech attackers. We argue that a systematic study of security policies and processes is sorely needed, and present a research agenda.