3 ms·

But, you need to make sure the extra controls are actually providing depth. I think in some (very narrow) cases, short session times and aggressive reauth do a

But, you need to make sure the extra controls are actually providing depth. I think in some (very narrow) cases, short session times and aggressive reauth do add depth and can be an effective part of a security program. But, all too often, defense in depth is used to mean: * Vendors In Depth, whereby every security tool under the sun has to be deployed (or at least purchased) to achieve “security”. Or, worse, the Noah’s Ark model where you buy two of everything. * Uncoordinated and/or seemingly random layering of controls that either don’t add to the overall confidentiality, integrity, or availability of the system being protected. Or, worse, are positively counterproductive and actively reduce the real-world security of the system.

pxc 3y ago
> Vendors In Depth Vendors will always love the phrase 'defense-in-depth' more than they care about assessing whether additional layers of tooling and controls actually provide more defense, because a vague appeal to defense-in-depth is a great way to justify purchasing more security software. It would be naive to think this doesn't affect the volume of research produced promoting and emphasizing the importance of defense-in-depth either, or how frequently papers on basically any kind of attack end with something that means 'this is why a defense-in-depth approach is needed in XYZ area' even when defense-in-depth is at best incidental to the substance of the paper. You can trivially tack that on to the end of pretty much any paper about any exploit, which raises the question of how meaningful an observation it really is.