=

The passage around this formula

There is a simple way to see why capability removal should be the default move rather than the fallback. Model the expected exposure created by a credential as a sum over the capabilities c it carries, each with some probability $p_c$ that it is exploited in a given period and some damage $d_c$ if it is: $E = \sum_{c} p_c \, d_c$. Two of the terms in that sum are hard to know honestly. An estimate of $p_c$ assumes a threat model that has to guess at an adversary’s behaviour, and $d_c$ is only bounded once you have already imagined the worst plausible use of the capability — the same failure of imagination that undermines defense-in-depth probability estimates generally. But there is one operation…

Read this part in the article →