Experimenting with security policy

This paper reviews the role of experimentation when assessing the practical properties of security policy tools and mechanisms, particularly those properties relevant to military environments. While security policy has long provided a rich area for information security research, the fruits of this research have not always provided major benefits in practice. In hopes of addressing this problem, the DARPA Information Assurance program has sought to experiment with practical aspects of security policy. This paper examines two areas of policy experimentation and lessons learned by such efforts. The areas include mapping policy to real world problems, and making preplanned policy changes in response to changes in the defense “information condition” or INFOCON