1 | A reference model describes how and where a secure system enforces security policies |
2 | A security model normally defines a specific set of security policies (too restrictive!) |
3 | The security reference model is a meta-policy because it is intended to encompass all possible security policies supported by the OMA (Object Management Architecture) |