I have been reading a security checklist for web application design which can be found on:
http://msdn.microsoft.com/en-us/library/ff648647.aspx
One of the recommendations is to "use multiple gatekeepers". I have read the explanation for it but I didn't understand anything. Here is the explanation:
On the server side, you can use IP Security Protocol (IPSec) policies to provide host restrictions to restrict server-to-server communication. For example, an IPSec policy might restrict any host apart from a nominated Web server from connecting to a database server. IIS provides Web permissions and Internet Protocol/ Domain Name System (IP/DNS) restrictions. IIS Web permissions apply to all resources requested over HTTP regardless of the user. They do not provide protection if an attacker manages to log on to the server. For this, NTFS permissions allow you to specify per user access control lists. Finally, ASP.NET provides URL authorization and File authorization together with principal permission demands. By combining these gatekeepers you can develop an effective authorization strategy.
Basically, what I would like to know is, what is meant by "multiple gatekeepers"? Thank you :)