Secrecy assumes perfect operation even with adverse code if the system has non-bypassable access code and no covert channels. This is not true of integrity or denial of service, etc. It is necessary to trust other systems to which the user is loosely coupled to perform properly. There is a need to classify the ways that interconnected systems fail and whether a fault in a particular distributed component, because this can radically affect the overall performance of another part. Security Fault Classification in Fault Prevention and Fault Tolerance Assessing system security is difficult.
Criteria normally concentrate on assessing techniques for building it.
This does not give a measure such as MTBF or time to first failure. These must be counterbalanced by cost and performance effects, etc. The areas of system design and maintenance can be improved by the use of formal methods. However, the techniques have not proven easy to apply and there is a substantial feeling on the part of many research funders that the methods are still in their infancy and this nowhere near as close to being useful or economically applied today. Obviously, this implies domain analysis.