> This sounds increasingly like security theater. It does help. Quite a bit. Each layer (e.g. firewall rules that require that all internet access go through

> This sounds increasingly like security theater. It does help. Quite a bit. Each layer (e.g. firewall rules that require that all internet access go through a proxy), adds non-trivial amount of work for the hacker to get anything useful done. 1. best case - hacker will give up. 2. good case - you have more time to notice and react. How much layer cost you, how much does it cost for hacker to overcome it. Things to remember: 1. Not all hackers are nation states. Most are not. 2. We must accept that no security measure is absolute even against script kidies. Given enough time and luck/misfortune js sandbox will do "rm /sensitive/file". Recent Log4shell example shows that one can follow all best practices and still get bit in unexpected way.