existing taxonomies were meant to be both broad and rigorously
defined instead of intuitive and specific. Overall, most of the
schemes cannot easily be applied to organizing security rules
used by a software developer who wants to learn how to build