News for hackers. Stuff that matters.
Re:Zero-Day Exploitation of Atlassian Confluence by FeepingCreature on Friday June 03, 2022 @02:55AM (#31605076)
The metaphor of plugging holes in a wedge of swiss cheese is actually the basis for the aviation industry's security model!

https://en.wikipedia.org/wiki/Swiss_cheese_model

Re:Zero-Day Exploitation of Atlassian Confluence by rob74 on Friday June 03, 2022 @11:07AM (#31609322)
It's more a risk management model than a security model. It tries to build a safe system from layers that are not 100% safe (e.g. because components on a plane may fail or people may not follow procedures exactly). That's why in an airplane accident it's not usually one single cause, but a whole string of things that have gone wrong. But still, we should try to keep the holes in the individual layers of cheese as small and as few as possible...
Re:Zero-Day Exploitation of Atlassian Confluence by JohnJamesRambo on Friday June 03, 2022 @08:33AM (#31607361)
This is really neat and novel to me, thanks for sharing.
Re:Zero-Day Exploitation of Atlassian Confluence by bombcar on Friday June 03, 2022 @09:16AM (#31607795)
The IT version of it is sometimes called "defense in depth" - even if each individual layer has weaknesses, combining them gets something stronger.

This often doesn't apply in cryptography; where adding two separate functions may result in a system that is actually weaker to attack.

Re:Zero-Day Exploitation of Atlassian Confluence by rob74 on Friday June 03, 2022 @11:09AM (#31609351)
Well yeah, if you put two slices of Swiss cheese side by side instead of on top of each other, you have given the attacker a wider choice of holes...