Paper submitted to Computers & Security