Why should web applications use multiple gatekeepers?

Question

I have been reading a security checklist for web application design which can be found on:

http://msdn.microsoft.com/en-us/library/ff648647.aspx

One of the recommendations is to "use multiple gatekeepers". I have read the explanation for it but I didn't understand anything. Here is the explanation:

On the server side, you can use IP Security Protocol (IPSec) policies to provide host restrictions to restrict server-to-server communication. For example, an IPSec policy might restrict any host apart from a nominated Web server from connecting to a database server. IIS provides Web permissions and Internet Protocol/ Domain Name System (IP/DNS) restrictions. IIS Web permissions apply to all resources requested over HTTP regardless of the user. They do not provide protection if an attacker manages to log on to the server. For this, NTFS permissions allow you to specify per user access control lists. Finally, ASP.NET provides URL authorization and File authorization together with principal permission demands. By combining these gatekeepers you can develop an effective authorization strategy.

Basically, what I would like to know is, what is meant by "multiple gatekeepers"? Thank you :)

Answer 1

While I personally disagree to the use of the term "gatekeepers" in this sense, I believe they are referring to the various defense components/modules that make-up a defense in depth stratergy for the same.

An example of this would be, while a web.config file cannot be read via HTTP in plaintext, any user logged into the system via a remote desktop solution (SSH, rDesktop, VNC, TeamViewer,PowerShell, etc) would be able to read it clearly. In such a case, not only wil you have to configure IIS Web Permissions to block access but you will have to be configure NTFS (File System) permissions to specify which users may read/write/execute that particular file.

Therefore, I believe they are saying that a serial combination of these "gatekeepers" will help you in developing an effective authorization stratergy.

Answer 2

We used a static IP or an IP ranges as a second factor authenticator for privileged users and devices. See also OWASP Application Security Verification Standard https://www.owasp.org/index.php/Category%3aOWASP_Application_Security_Verification_Standard_Project although I did not find IP multifactor authentication covered there.