Defense in Depth
Overview¶
Defense in Depth is the practice of implementing multiple independent layers of protection so that the failure of any single control does not result in a system compromise. It is not enough to stop once you have implemented a single security measure.
Core assumption of Defense in Depth
Every security control can fail, and in unexpected ways.
Which is an extension of the Principle of Assume Breach.
For example:
- A firewall can be misconfigured.
- A user can fall for phishing.
- An administrator can make a mistake.
- A developer can introduce a weakness/CWE.
- A monitoring system can miss an alert.
Because individual controls are imperfect, systems should be designed so that multiple controls must fail before a significant impact occurs.
Rather than relying on a single protection mechanism, Defense in Depth introduces overlapping safeguards across people, processes, architecture, infrastructure, applications, identities, and data. This approach creates friction for attackers while simultaneously reducing the blast radius of failures.
Layers Matter More Than Products¶
Defense in Depth is often mistakenly implemented as a collection of security products.
Buying more tools does not automatically improve security.
The goal is not:
- More software.
- More alerts.
- More vendors.
- More complexity.
The goal is:
- Independent protections.
- Interconnected detections.
- Reduced attack paths.
- Reduced blast radius.
- Faster detection.
- Faster recovery.
A well-designed architecture with fewer tools is often more secure than a complex architecture having dozens of poorly integrated products.
flowchart TB
Internet[Attacker]
Internet --> Identity
Identity --> Device
Device --> Network
Network --> Application
Application --> Data
Operations[Monitoring & Response]
Operations -.-> Identity
Operations -.-> Device
Operations -.-> Network
Operations -.-> Application
Operations -.-> Data
Defense in Depth Is an Engineering Principle¶
Many engineers think of Defense in Depth as a cybersecurity concept.
While security teams often discuss it, the principle applies equally to engineering disciplines:
| Discipline | Example |
|---|---|
| Software Engineering | Input validation, authorization checks, secure APIs, runtime monitoring |
| Cloud Engineering | Landing zones, network segmentation, managed identities, policy enforcement |
| Infrastructure Engineering | Hardened operating systems, host firewalls, remote administration controls |
| Systems Engineering | Redundancy, fault isolation, change control, disaster recovery |
| Security Engineering | Detection, prevention, containment, response |
Successful engineering organizations do not rely on a single organization, control, service, or assumption.
Instead, systems are designed so that failure stays manageable.
Thinking Like an Attacker¶
Attackers rarely compromise systems through a single action.
Most compromises are chains of events.
For example:
flowchart
n1["Phishing Email"]
n2["Credential Theft"]
n3["MFA Bypass\n(not needed in AITM)"]
n4["Lateral Movement"]
n5["Privilege Escalation"]
n6["Ransom/Data Theft/Deface/DoS"]
n1 --> n2
n2 --> n3
n3 --> n4
n4 --> n5
n5 --> n6
Examples¶
Physical¶
Physical access often bypasses logical security controls.
- Secured facilities.
- Locked server rooms.
- Hardware protections.
- Video surveillance.
- Physical access controls.
Physical security is still relevant in cloud environments because providers implement extensive physical protections for their datacenters.
Cloud Physical Security
It is critical to validate that your cloud providers have implemented strong physical security controls.
Identity¶
Identity has always been the primary security boundary.
It hasn't been until recently that technology has become available to implement strong identity protections at scale.
Info
The people who invented the network/firewall perimeter approach even made the concession that the firewall approach was the best that was possible in the early 2000s with the current technology.
Examples include:
- Multi-factor authentication.
- Password-less authentication.
- Conditional access.
- Risk-based authentication.
- Identity governance.
- Privileged Identity Management.
- Privileged Isolation.
Many modern attacks target identities instead of infrastructure as it is much easier to compromise a single identity than to compromise an entire server or network.
Protecting identities is often more valuable than protecting individual servers due to simpler security configurations giving higher return on investment.
Endpoint¶
Endpoints are the environment where users and administrators interact with systems.
Examples include:
- Device compliance policies.
- EDR.
- Application control.
- Disk encryption.
- Attack surface reduction rules.
- Hardened privileged workstations.
Clean Source Lives Here
A compromised endpoint can undermine otherwise secure infrastructure, no matter how perfectly secured the systems are.
See the clean source principle for more information on how this relationship works.
Network¶
Networks should not be assumed trustworthy.
Assume Breach
All networks should be treated as the raw internet when designing the workloads they host. The Principle of Assume Breach demands it.
Examples include:
- Micro-segmentation.
- Next Generation Firewalls.
- No UPnP.
- No VPNs.
- Zero Trust/Assume Breach networking.
- Network monitoring.
- Intrusion detection.
- Network-based Web Application Firewalls.
Application¶
Applications often become the primary target as the rise of AI has started to create a lot of extra security risks.
Examples include:
- Secure development lifecycle
- Static analysis
- Dependency scanning (not just CVEs)
- Application/host-based Web Application Firewalls
- Runtime protection
- Input validation
- Authorization controls
Security controls should exist both inside and outside the application. Side channel attacks exist to bypass controls in unexpected ways, so it is important to implement multiple layers of protection.
Monitoring¶
No preventative control is perfect. Detection should be treated as a security layer rather than an afterthought.
Examples include:
- Centralized logging
- Security monitoring
- Threat detection
- Anomaly detection
- Incident response processes
You should assume some attacks will succeed and plan accordingly.
Similarities to CIA¶
Defense in Depth is the complete picture of the state of mind, where CIA is a tool to help you get there.
CIA provides a framework for thinking about a subset of controls, while Defense in Depth provides a strategy for implementing security controls wholistically.
See Also¶
- CIA Triad
- Wikipedia - Defense in Depth
- Microsoft - Well Architected Framework - Security
- Microsoft - Attacker ROI
- Google - Defense in Depth
- Google - Site Reliability Engineering
- NIST - Defense in Depth
- CISA - Secure by Design