Defense in Depth

Defense in depth is a security strategy that layers multiple, independent controls so the failure or bypass of any one layer does not compromise the whole system. Borrowed from military doctrine, it rejects the idea of a single "hard shell" perimeter in favor of redundant safeguards across the network, host, application, and data, on the assumption that any individual control can and eventually will fail.

How It Works

Controls are stacked across layers so an attacker must defeat several to reach a target. At the network layer: firewalls, segmentation, and intrusion detection. At the host layer: hardened OS configuration, endpoint protection, and patching. At the application layer: input validation, authentication, authorization, and output encoding. At the data layer: encryption at rest and in transit, tokenization, and strict access control. Surrounding all of it: logging, monitoring, and incident response.

The layers should be independent, so a weakness in one does not automatically defeat the next. For example, even if an attacker bypasses the WAF, application-level input validation still blocks injection; even if they reach the database, encryption and least-privilege accounts limit the damage. The point is graceful degradation of security rather than all-or-nothing.

When to Use It

Defense in depth is a baseline for essentially all systems handling sensitive data or facing untrusted input — which is to say, most production systems. It is mandated or implied by frameworks like NIST, ISO 27001, and PCI DSS. It is especially important for high-value targets, regulated environments, and anything internet-facing, where a single control's failure would otherwise be catastrophic.

Trade-offs

More layers mean more cost, complexity, and operational overhead, and can add latency or friction for users and developers. Redundant controls can create a false sense of security if they are not actually independent (e.g. all relying on the same identity provider). Poorly tuned layers generate alert fatigue. The art is choosing layers that meaningfully reduce risk for the threat model rather than piling on controls indiscriminately.

Related Patterns

Defense in depth is the umbrella under which least privilege, secure-by-default, and zero-trust segmentation operate as specific layers. The bulkhead pattern applies the same isolation philosophy to resilience. Together these implement the modern "assume breach" posture.

Example

A web application protecting customer records might layer: a CDN/WAF filtering common attacks; TLS everywhere; network segmentation isolating the database subnet; an application that validates input and enforces authorization on every request; database accounts scoped to least privilege; column-level encryption for PII; and centralized audit logging with alerting. An attacker who slips past the WAF still faces input validation; one who compromises the app server still cannot read PII without the encryption keys, and every step they take is logged.