Information security isn't just about software and hardware -- it's at least as much about policies and processes. But the research community overwhelmingly focuses on the former over the latter, while gaping policy and process problems persist. In this experience paper, we describe a series of security policy audits that we conducted, exposing policy flaws affecting billions of users that can be -- and often are -- exploited by low-tech attackers who don't need to use any tools or exploit software vulnerabilities. The solutions, in turn, need to be policy-based. We advocate for the study of policies and processes, point out its intellectual and practical challenges, lay out our theory of change, and present a research agenda.

翻译：信息安全不仅仅是软件和硬件,至少与政策和流程有关。但研究界绝大多数关注前者而不是后者,而政策与流程问题仍然存在差距。在本经验文件中,我们描述了我们进行的一系列安全政策审计,揭示了影响数十亿用户的政策缺陷,这些用户可能 -- -- 而且往往是 -- -- 被那些不需要使用任何工具或利用软件脆弱性的低技术袭击者所利用。解决方案反过来需要以政策为基础。我们主张研究政策和流程,指出其知识和实际挑战,提出我们的变革理论,并提出研究议程。