subscript

The passage around this formula

Two of the terms in that sum are hard to know honestly. An estimate of $p_c$ assumes a threat model that has to guess at an adversary’s behaviour, and $d_c$ is only bounded once you have already imagined the worst plausible use of the capability — the same failure of imagination that undermines defense-in-depth probability estimates generally. But there is one operation available to a system designer that requires no estimate at all: revoke the capability, and its term leaves the sum exactly, not approximately. Better monitoring reduces your uncertainty about $p_c$ . Removing c removes the need to know it. That is the quantitative case for treating scope reduction as the first move rather than “we…

Read this part in the article →