Comparison
Defence in depthvsFailure domain
Defence in depth
the validation was bypassed and the database constraint caught it anyway.
Assuming any single control will eventually fail and putting independent ones behind it. It applies well beyond security: a rate limit at the gateway and in the service, validation at the edge and in the schema, a review gate and a canary. The requirement people miss is independence — three checks that all read the same misconfigured flag are one control wearing three hats.
Full entry →Failure domain
one region went down and you found out which of your services quietly lived only in that region.
The set of things that fail together when one thing fails. Drawing them is how an availability argument becomes concrete: a shared database, an availability zone, a single deployment pipeline and one overloaded team are all failure domains, and the last two do not appear on the architecture diagram. The design question is never 'can this fail' but 'when it does, what is inside the boundary with it'.
Full entry →