A reference model for security level evaluation: Policy and fuzzy techniques