Question: I've asked a few questions relating to schemes for various security-related functions, and posited schemes to accomplish those goals. In the responses, I see a conflict between two fundamental principles of IT security; "defense in depth" (make an attacker break not one, but many layers of information security) and "Complexity is the enemy of security" (the KISS principle).

The question IMO is obvious; when does one of these two take priority over the other? You can't have both in the extreme; adding layers necessarily increases complexity of the system, while simplifying security typically "thins" it. There's a spectrum in between "ideal" complete simplicity and "ideal" infinite depth, and thus a balance to be struck. So, which of these, when they conflict, is generally to be preferred in the design of an information security scheme?

Answer: 
"Defense in depth" is usually pushed out of a feeling of paranoia. You implement layers upon layers of defense in response to panicky rants from upper management.

"Low complexity" is usually promoted in order to reduce costs and delivery times. You reduce complexity so as to meet the deadlines imposed from upper management.

Often, "upper management" will insist on both aspects at the same time. It is then your job to notify them of how irksome and pesky details like the Laws of Physics may prevent or slow down the simultaneous fulfillment of both goals.

Ultimately, this is not a technical decision; this is about *economics*. Risk analysis ought to put a price on intrusions, and thus assess how much money defense in depth may save in the long run, by containing damage resulting from a successful attack. Similarly, increased development costs and delays will be given their own financial estimate. It is up to the decision-makers to balance these costs as it best suits their strategy; the important point being that this is a matter of *policy*, not of *technology*.
Defense in depth and simplicity are not contradictory as long as each layer is simple and independent. Each layer should not be dependent on other layers or it really isn't good defense in depth. (Since it really is just one complex layer at that point.) If each layer can be worked with separately and is implemented in a simple, verifiable and maintainable way, then there is really nothing at odds.