Defense in depth is a security strategy that layers multiple independent controls so that if one fails, others continue to protect the asset. The concept comes from military strategy: a castle has a moat, walls, towers, gates, and armed defenders. Each layer slows and weakens an attacker, and no single layer's failure means defeat.
In cybersecurity, defense in depth means you do not rely on any single control, no matter how strong it appears. Firewalls fail. Antivirus misses threats. Users click phishing links. Patches are delayed. Any individual control can be bypassed; the layers make successful bypass of all controls improbable.
Physical security. Locked server rooms, access badges, surveillance cameras, environmental controls. Physical access bypasses most technical controls.
Network security. Firewalls, network segmentation, intrusion detection/prevention systems, VPNs, and network monitoring. These controls restrict and monitor traffic between network zones.
Endpoint security. Antivirus/EDR, host-based firewalls, application allowlisting, device encryption, and patch management. These protect individual devices regardless of network position.
Application security. Secure coding practices, input validation, authentication and authorization controls, security headers, and WAFs. These protect the software users interact with.
Data security. Encryption at rest and in transit, DLP, access controls, data classification, and backup/recovery. These protect the information that is ultimately the target of most attacks.
Identity and access management. Authentication (MFA), authorization (RBAC), privileged access management, and identity monitoring. These control who can access what.
Security operations. Monitoring, logging, alerting, incident response, and threat hunting. These detect and respond to threats that bypass preventive controls.
People and process. Security awareness training, policies and procedures, background checks, and separation of duties. These address the human element.
Effective defense in depth is not about deploying as many tools as possible. It is about understanding your critical assets, identifying the most likely attack paths, and ensuring multiple independent controls protect each path.
For each critical asset, map the attack paths an adversary would take. At each step, identify which controls would prevent, detect, or slow the attack. If a single control is the only thing standing between the attacker and the asset, add another layer.
Example: Protecting a web application database. Layer 1: WAF blocks common attack patterns (prevention). Layer 2: Input validation in the application rejects malicious input (prevention). Layer 3: Parameterized queries prevent SQL injection even if validation misses something (prevention). Layer 4: Database account has minimum necessary permissions (damage limitation). Layer 5: Database activity monitoring detects unusual queries (detection). Layer 6: Data is encrypted at rest so a database dump is useless without keys (damage limitation). Layer 7: Backups enable recovery if data is destroyed (recovery).
No single layer is sufficient. Together, they make successful data theft extremely difficult and ensure rapid detection and recovery if it occurs.
Layer redundancy without independence. Running two antivirus products from the same vendor that use the same detection engine is not defense in depth. The layers must be independent, so that a weakness in one does not apply to others.
Focusing only on prevention. Detection and response layers are equally important. If all your layers are preventive, a single bypass gives the attacker undetected access. Include monitoring, logging, and response capabilities.
Security theater layers. Controls that create the appearance of security without actually reducing risk. A firewall with overly permissive rules, an IDS nobody monitors, or a policy nobody follows are not effective layers.