Security Reasoning for Distributed Systems with Uncertainty