The metaphor of plugging holes in a wedge of swiss cheese is actually the basis for the aviation industry's security model!

https://en.wikipedia.org/wiki/Swiss_cheese_model

It's more a risk management model than a security model. It tries to build a safe system from layers that are not 100% safe (e.g. because components on a plane may fail or people may not follow procedures exactly). That's why in an airplane accident it's not usually one single cause, but a whole string of things that have gone wrong. But still, we should try to keep the holes in the individual layers of cheese as small and as few as possible...

This is really neat and novel to me, thanks for sharing.

The IT version of it is sometimes called "defense in depth" - even if each individual layer has weaknesses, combining them gets something stronger.

This often doesn't apply in cryptography; where adding two separate functions may result in a system that is actually weaker to attack.

Well yeah, if you put two slices of Swiss cheese side by side instead of on top of each other, you have given the attacker a wider choice of holes...

Your link points to a vulnerability that could have been mitigated by putting the internal application developped with Apache Struts behind a proxy server like Nginx or GCP Identity Aware Proxy (IAP) that authenticate the request before the request is forwarded to the application server.

This only applies to apps for internal use like Confluence or Jenkins, not publically accessible websites.

Proxy preauth could be able to mitigate a vulnerable framework. The idea is that you never connect to the application server itself, but to a proxy that requires a separate authentication. That’s obviously not possible for a public-facing application.

Now, if the attacker has access to the proxy authentication, all of this doesn’t help much, but at least you could track and limit who can access what chunks.

My confluence server is behind a proxy which requires a valid client certificate to talk to the server

I have other proxies which require OIDC authentication before passing any packets on

Now sure, I'm still vulnerable to internal attackers from my company, but that's an audited trail to a real specific user, not just a random botnet on the internet.

Smaller attack surface internally, for sure. I also assume internal networks are hostile, not just from internal threats, but from external lateral movement.

I'm don't follow. If you have a pre-auth reverse proxy in front of your web application, you drastically reduce your attack vector.

An unauthenticated attacker can no longer simply rely on a vulnerability in the application or underlying framework, but must first obtain an employee's credentials, or find another vulnerability in the proxy or authentication infrastructure.

This isn't a false sense of security. It is a concrete additional layer of security which has tangible benefits.

I don't * - Too late to edit.

Plug enough holes though and at some point it starts to have effect.

The real problem is if there only one wedge, you need to combine that strategy with multiple layers of security to get anywhere, otherwise the first hole is the last.