Comparison
Attack surfacevsDefence in depth
Attack surface
the feature added one endpoint, and that endpoint took a file path from the client.
Everything an untrusted party can reach and influence — endpoints, parameters, file uploads, dependencies, admin tools, the CI system. It grows quietly with every convenience added, and shrinking it is usually cheaper than defending it. It belongs in ordinary design review, not only security review, because the least defensible surface is the one nobody realised they had added.
Full entry →Defence in depth
the validation was bypassed and the database constraint caught it anyway.
Assuming any single control will eventually fail and putting independent ones behind it. It applies well beyond security: a rate limit at the gateway and in the service, validation at the edge and in the schema, a review gate and a canary. The requirement people miss is independence — three checks that all read the same misconfigured flag are one control wearing three hats.
Full entry →