I created a security migration tool in Tridion 5.2 but the solution approach will still apply to current versions of Tridion
Summary
The solution used a set of simple vbscript export page templates to extract the security information as xml and store it in a set of components.
I then used Tridion Content Porter to move these security components, page templates and tbbs's to the target CMS's
Using set of simple import page templates to open the security xml components to apply the security setting to the target cms.
The tcmid's will be different in the target cms so the import functions must use webdav urls and build dictionaries of tcmid's for trustees etc
Details
Export Security Groups
iterate selected Groups
append group xml
save xml in component
Export Publication Rights
getlistpublications
iterate list of publications
get each publication xml
remove "//tcm:CategoriesXSD" node
appendChild publication xml
remove unwanted "//tcm:Trustee" nodes
save xml in component
Export Folder Permissions
Export Structure Group Permissions
recursively iterate Structure groups
append structure group XML
remove metadata node "//tcm:Metadata"
filter out unwanted Trustees
save xml in component
Import Security Groups
Import Publication rights
Import Folder Permissions
Import Structure Group Permissions