well said and i agree. i believe we are talking about different layers. your point - essentially assume your network is always breached - absolutely. and don

well said and i agree. i believe we are talking about different layers. your point - essentially assume your network is always breached - absolutely. and don't you make that 'battle hardening' simpler and more effective by reducing the attack surface? e.g. by taking your servers off the internet (meaning your inbound firewall rules become deny all inbound (even 443)). so enforce (strong) auth outside your dmz, before allowing sessions on your network (or overlay network), even for APIs, B2B etc (otherwise your fw has exceptions). and, yes, when that gets compromised, the attacker now needs to deal with the next set of 'battle hardened' layers. meaning, shouldn't reducing attack surface and battle hardened services be an 'and', not an 'or'?