CSS Analyses in Security Policy