Using Deontic Logic for Security Policy Specification

This paper analyses the problem of specifying a security policy for organizations. First, various issues related to the problem of an adequate and rigorous specification of a security policy are outlined in a context where security requirements usually remain informal and are difficult to satisfy. Then, it is proposed to use a logical language, previously studied in the literature, that seems to exhibit the adaptability needed for such tasks. The definition of this formalism is provided. We focus on the problem of its practical use and propose a graphical approach supported by a tool. A security policy specification example is presented to illustrate this approach.