On the Definition of Survivability

The computer systems that provide the information underpinnings for critical infrastructure applications, such as banking systems and telecommunications networks, have become essential to the operation of those applications. Failure of the information systems will often cause a major loss of service, and so their dependability has become a major concern. Current facets of dependability, such as reliability and availability, do not address the needs of critical information systems because they do not include the notion of degraded service as an explicit requirement. What is needed is a precise notion of what forms of degraded service are acceptable to the application, under what circumstances each form is most useful, and the fraction of time degraded service levels are acceptable. This concept is termed survivability and in this paper we show that it is a necessary new facet of dependability. We present a formal definition of survivability and present an example of its use.