aa17-aug-sep-2006-it-security-the-danish-pastry-approach