Comparison
Defence in depthvsSwiss cheese model
Defence in depth
the validation was bypassed and the database constraint caught it anyway.
Assuming any single control will eventually fail and putting independent ones behind it. It applies well beyond security: a rate limit at the gateway and in the service, validation at the edge and in the schema, a review gate and a canary. The requirement people miss is independence — three checks that all read the same misconfigured flag are one control wearing three hats.
Full entry →Swiss cheese model
there were four safeguards and the change slipped through a hole in each of them on the same afternoon.
A model of accident causation in which each defence is a slice with holes, and a failure occurs when the holes momentarily line up. It explains why serious incidents rarely have one cause and why removing one hole is still worthwhile even though others remain. It is the conceptual backing for defence in depth, and the reminder that a defence you never verify has holes you cannot see.
Full entry →