Chapter 32 — Security governance, risk and compliance: reliability
Lesson map
Lesson 32 published. Map, example, EX094.
flowchart TD
N0["Learning outcomes"]
N1["32.1 Layered controls"]
N2["32.2 Common cause"]
N3["Lab — Joint failure of two controls with and without"]
N4["32.3 Designing for independence"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX094"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["32.1 Layered controls"]
N2["32.2 Common cause"]
N3["Lab — Joint failure of two controls with and without"]
N4["32.3 Designing for independence"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX094"]
[Learning outcomes]
|
v
[32.1 Layered controls]
|
v
[32.2 Common cause]
|
v
[Lab — Joint failure of two controls with and without]
|
v
[32.3 Designing for independence]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX094]
Learning outcomes
You will (1) compute the probability that layered controls both fail; (2) account for common-cause failure; (3) design for independence.
32.1 Layered controls
Ardwell protects vendor access with two layers: the broker's approval check and network rules that block unapproved routes. Nadia asks how likely it is that both fail at once. If the approval check fails five percent of the time and the network rules ten percent, and failures are independent, both fail only half a percent of the time. Layering seems to give strong protection. Reliability engineering, however, warns that independence is an assumption that must be justified before it is trusted. A single administrator able to change both layers would be one such shared dependency, as the next section shows.
32.2 Common cause
The lab adds a two percent chance of a common cause that defeats both layers at once, such as an administrator account able to change both the broker and the network rules. The joint failure probability rises from one half of a percent to about two and a half percent, five times higher. Nadia sees that the common cause dominates the result. Improving either layer alone barely helps; removing the shared dependency matters far more. This explains why her design work now focuses on separating administration rather than improving either layer's failure rate.
Lab — Joint failure of two controls with and without common cause
"""Failure probability of two controls: independent vs with a common cause (synthetic)."""
p1, p2, beta = 0.05, 0.10, 0.02
ind = p1*p2
cc = beta + (1-beta)*p1*p2
print(f"single control A fails {p1:.2%}; B fails {p2:.2%}")
print(f"both fail if independent {ind:.2%}")
print(f"both fail with 2% common cause {cc:.2%}")
Run with python3 lab_layers.py. Verified output:
single control A fails 5.00%; B fails 10.00%
both fail if independent 0.50%
both fail with 2% common cause 2.49%
32.3 Designing for independence
Nadia recommends separating administration of the broker and network rules between different teams with different accounts, logging changes to both in a system neither team controls and testing them separately. She notes that common causes also include shared training, shared suppliers and shared assumptions. Prof. Brenner adds that governance reports often count layers as if each were independent, so stating dependencies explicitly is a sign of mature risk analysis and a frequent gap in audit evidence. Separate teams and accounts would remove the two percent common cause the lab modelled.
Worked example
Nadia computes 0.50% joint failure for independent layers and 2.49% with a 2% common cause, then separates administration to reduce it.
Synthetic case. Failure rates are synthetic.
Errors and limits
Common-cause rates are hard to estimate. Separation adds cost.
Exercises
- EX094 — Independent joint. What is the joint failure probability for independent layers? Rubric: 3 = 0.50%;; 2 = 0.005;; 1 = vague;; 0 = none.
- EX095 — Common-cause joint. How large is the joint failure probability with a 2% common cause? Rubric: 3 = 2.49%;; 2 = about five times;; 1 = vague;; 0 = none.
- EX096 — Best fix. What reduces joint failure most? Rubric: 3 = removing the shared dependency;; 2 = independence;; 1 = stronger single layer;; 0 = none.
Synthesis
Layered controls are only as strong as their independence; common causes dominate joint failure.
Continue studying — chapter 32 of 50
← Chapter 31 (draft) · Course chapter index · Chapter 33 (draft) →