Thirty Years Later: Lessons from the Multics Security Evaluation (2002) [pdf]