Defense in depth is just a design philosophy for security controls. It absolutely makes sense and doesn’t have to be implemented as “disjoint security software/

Defense in depth is just a design philosophy for security controls. It absolutely makes sense and doesn’t have to be implemented as “disjoint security software/vendors/contracting” It can be the justification for things like database controls, OS level controls, or seemingly trivial things like log forging. I heard a million different versions of “it’s not a big deal because an attacker would have to breach our network already”