McLean, J.D., "Assurance Risk Assessment, and Fuzzy Logic",
Proceedings of the 17th National Computer Security Conference, Baltimore, 
MD, 1994, pp 483-486,
1994.

<blockquote>
To evaluate the effectiveness of techniques used to build secure
systems some sort of quantitative measure of penetration resistance is
desirable.  However, fuzzy logic is the wrong way to go since a single
fuzzy metric of system security hides the information that was used to
generate the metric and since there is an inherent danger of giving
quantitative fuzzy metrics more credence than they really
deserve. Certainly with respect to confidentiality, and possibly with
respect to integrity and availability as well, information theoretic
approaches, though not perfect, are more suitable.  Money would be
better spent furthering such approaches, rather than developing fuzzy
new ones.
</blockquote>