defects that recur in different contexts.
The objective of the Protection Analysis (PA) project [3] was to
enable anybody (with or without any knowledge about computer
security) to discover security errors in the system by using a