Defense in Depth
Principle: Security should be viewed holistically. Wherever possible, multiple levels of security controls should be used. No single control provides perfect security, but layering different controls makes attacks extremely complex and unlikely to succeed.
Key Aspects
Layered Security Controls
Implement multiple independent layers, each providing a different line of defense:
| Layer | Examples |
|---|---|
| Network | Firewalls, network segmentation, VPN, private subnets |
| Host | OS hardening, host-based IDS, patch management |
| Application | Input validation, authentication, authorization, output encoding |
| Data | Encryption at rest and in transit, access controls, backup |
| Monitoring | Intrusion detection, log aggregation, alerting, SIEM |
Redundancy and Diversity
- If one layer is compromised, other layers still provide protection
- Use controls from different vendors or implementations to avoid a single vulnerability defeating all layers
- Avoid relying on a single security mechanism for any critical protection
Compartmentalization
- Isolate system components to limit lateral movement after a compromise
- Use network segmentation, separate namespaces, and distinct trust zones
- Apply the blast radius test: "If this component is compromised, what else is affected?"
Continuous Monitoring and Updating
- Continuously update and adapt security measures to address emerging threats
- Monitor all layers for anomalies, not just the perimeter
- Regularly test controls through penetration testing and red team exercises
Architecture Review Questions
When reviewing a system's security architecture, ask:
- What happens if the firewall/WAF is bypassed? Is there application-level input validation?
- What happens if authentication is compromised? Are there authorization checks on every resource?
- What happens if a service is breached? Can the attacker move laterally to other services?
- What happens if a database is accessed? Is the data encrypted at rest?
- What happens if an attacker operates undetected? Are there monitoring and alerting mechanisms?
If any answer is "nothing else protects us," that is a defense-in-depth gap.
Implementation Checklist
- No critical asset is protected by a single security control alone
- Network segmentation separates components into trust zones
- Application-level controls (input validation, authz) exist independently of network controls
- Data is encrypted at rest and in transit
- Monitoring and alerting cover all layers (network, host, application)
- Blast radius of a single component compromise is limited by isolation
- Controls are regularly tested and updated
