A reference model describes how and where a secure system enforces security policies |
A security model normally defines a specific set of security policies (too restrictive!) |
The security reference model is a meta-policy because it is intended to encompass all possible security policies supported by the OMA (Object Management Architecture) |