Merging Security Policies: Analysis of a Practical Example

It often happens that organizations or companies have to respect several security policies simultaneously. Here, we analyze a practical example which applies to the context of documents containing sensitive information. This example considers the problem of downgrading the classification of these documents when their contents become obsolete. There are several security policies that deal with this problem and it appears that these security policies are conflicting. In this paper, we suggest a general approach to detect and solve the conflicts between the security policies and show how it applies to our practical example.