> "Defense in depth" is just a way security product salespeople get customers to buy more stuff. "just" that? That's a very bold statement that most of the sec

> "Defense in depth" is just a way security product salespeople get customers to buy more stuff. "just" that? That's a very bold statement that most of the security community would disagree with. An example: you don't monitor network traffic on the border because you trust your server not to be compromised. Then one gets compromised and the incident goes undetected due to lack of monitoring. > If you remove attack surface altogether That's a big if. Services can have a complex life, with software and configuration changing often. Unless you pull the plug you attack surface is never going to be zero and, on top of that, there so guarantee that it stays small. Hence organizations usually have different people taking care of different layers.