134 A metric first proposed in F. Stevens, “Validation of an Intrusion-Tolerant Information System Using
Probabilistic Modeling” (MS thesis, University of Illinois, Urbana-Champaign, IL, 2004).
135 National Computer Security Center (NCSC), A Guide to Understanding Configuration Management in Trusted
Systems, report no. NCSC-TG-006-88 (Fort Meade, MD: National Security Agency, March 28, 1988).