Security concepts & principles
Defense in Depth
Overview
Defense in depth layers multiple independent controls together, on the assumption that any single control can fail — so no one point of failure compromises the whole system.
Key concepts
- Seven layers: administrative, physical, network, endpoint, identity, data, monitoring/recovery
- No single defense should be relied on alone
How it works
Defense in depth is a security strategy that uses multiple layers of protection, on the assumption that any individual control can fail, be bypassed, or be misconfigured. If one layer fails, other layers should prevent, detect, delay, contain, or help recover from an attack — combining people, processes, physical controls, and technical controls.
The layers
| Layer | Examples |
|---|---|
| Administrative | Policies, procedures, training, risk assessments, incident-response plans. |
| Physical | Locks, badge readers, security cameras, locked server rooms, alarms, secure disposal. |
| Network | Firewalls, VLANs, VPNs, network segmentation, IDS/IPS, secure Wi-Fi. |
| Endpoint | Patch management, antivirus/EDR, disk encryption, secure configurations, application controls. |
| Identity | MFA, strong passwords, least privilege, account reviews, privileged-access management. |
| Data | Encryption, classification, access permissions, backups, data-loss prevention. |
| Monitoring & recovery | Centralized logs, SIEM alerts, backups, incident-response procedures, disaster-recovery plans. |
Putting defense in depth into practice
- Don't rely on just one defense, like a firewall or antivirus alone.
- Combine user training, email filtering, MFA, endpoint security, network segmentation, logging, and backups.
- Keep systems updated to reduce vulnerabilities.
- Restrict administrative privileges and review access regularly.
- Monitor systems for unusual activity and investigate alerts promptly.
- Test backups and incident-response plans before a real emergency happens.