Increased information flow needs for high-assurance composite evaluationsPaul A. KargerHelmut Kurth2004IEEE IWIA 2004Conference paper
Thirty years later: Lessons from the Multics security evaluationPaul A. KargerRoger R. Schell2002ACSAC 2002Conference paper