Defense Independence Verification¶

Why It Matters¶

Organizations proudly point to multiple safety systems, assuming they multiply protection. But if all defenses fail under the same conditions, you have redundancy without independence—the appearance of safety without the reality. This tool prevents complacency from defense counts and forces attention to defense diversity.

The Key Move¶

List all defenses that should prevent a particular failure. For each pair of defenses, ask: what conditions would cause both to fail simultaneously? Physical dependencies (same power source, same location)? Informational dependencies (both rely on same sensor)? Human dependencies (both require attention from same overloaded operator)? Organizational dependencies (both get degraded by same budget pressure)? Create a dependency matrix showing which defenses are coupled. Count independent defense sets (defenses with no common failure modes). Your actual safety is determined by the size of the smallest independent set, not the total defense count.

Classic Application¶

Nuclear power plant safety systems. Plants have multiple cooling systems, multiple containment barriers, multiple shutdown mechanisms. But investigation after Three Mile Island and Fukushima revealed common-cause vulnerabilities: backup systems sharing the same electrical bus (dependency), operators trained on similar mental models (cognitive dependency), maintenance budget cuts affecting all systems (organizational dependency). True independence requires defending against different failure types, not just duplicating the same defense.

Surprising Application¶

Information security practices. You use multiple defenses: VPN, firewall, antivirus, password manager, 2FA. Check for independence: VPN and firewall both fail if your device is compromised. Antivirus and password manager both fail if your operating system is backdoored. 2FA and password both fail if you're socially engineered into providing both. True independence requires defending against different attack vectors: technical controls (software), physical controls (hardware tokens), human controls (training). Same-type defenses provide less protection than different-type defenses.

Failure Modes¶

Perfect independence is impossible—everything shares some common failure modes (humans, physics, economics). The goal is to identify and minimize critical dependencies, not eliminate all coupling. Can become expensive—independent defenses often cost more than redundant defenses. Requires imagination to identify failure modes, and you can't test for modes you haven't imagined. May lead to complex defense architectures that themselves become reliability risks.

Go Deeper¶

Reason, Managing the Risks of Organizational Accidents, Chapter 11; Leveson, Engineering a Safer World, pp. 224-251; Pate-Cornell, "Learning from the Piper Alpha Accident: A Postmortem Analysis of Technical and Organizational Factors," Risk Analysis 13, 1993.