Catalog
concept#Security#Architecture#Reliability

Defense in Depth

Layered security principle that reduces risk through overlapping controls.

Defense in depth is a security concept that deploys multiple, overlapping layers of protection to complicate attacks and limit impact.
Established
Medium

Classification

  • Medium
  • Technical
  • Architectural
  • Intermediate

Technical context

Firewalls and network security appliancesIdentity and Access Management (IAM)SIEM / logging and monitoring platforms

Principles & goals

Multiple independent layers provide redundancy.Controls should complement each other and address different attack vectors.Security is technology-agnostic and requires organizational measures.
Build
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Apparent security when layers are redundant but flawed.
  • Costs for implementation and operation are underestimated.
  • Fragmented responsibilities hinder consistent implementation.
  • Combine layers with different technologies and control types.
  • Perform regular penetration tests and red teaming.
  • Set up automated monitoring and response paths.

I/O & resources

  • Asset inventory and classification
  • Threat model and risk analysis
  • Network and operational architecture
  • Documented protection layers and rules
  • Implemented controls and monitoring pipelines
  • Playbooks for incident response and recovery

Description

Defense in depth is a security concept that deploys multiple, overlapping layers of protection to complicate attacks and limit impact. It combines organizational measures, technical controls and operational processes. The approach is technology-agnostic and applies to networks, applications and organizational workflows.

✔

  • Increased resilience against single control failures.
  • Complicated attack paths through heterogeneous barriers.
  • Improved fault and incident isolation.

✖

  • Increased operational overhead from multiple controls.
  • Complexity can lead to configuration errors.
  • Not all layers are equally effective against every attack vector.

  • Mean Time to Detect (MTTD)

    Average time to detect a security-relevant event.

  • Number of independent protection layers

    Counts the functionally distinct protection layers within the architecture.

  • Percentage of automated responses

    Share of incident responses performed without manual intervention.

Segmentation of an enterprise infrastructure

A financial service segments internal systems, production networks and administrative access, combining firewalls with IAM and monitoring.

Secure cloud application

A cloud application uses network security groups, WAF, identity provider and daily backups as layered protection.

Operations center with redundancy

An operator combines monitoring, playbooks and isolated management networks to limit operational failures and attacks.

1

Inventory and classify all relevant assets.

2

Create a threat model and prioritize risks.

3

Define and implement core layers (network, application, operations).

4

Establish monitoring, testing and regular reviews.

⚠️ Technical debt & bottlenecks

  • Legacy tools without APIs hinder integration and automation.
  • Inconsistent configuration standards across layers.
  • Missing playbooks for combined failure/attack scenarios.
Skill bottlenecks in security teamsLegacy infrastructure with limited segmentationLack of automation for recovery processes
  • Neglecting logging in one layer leads to blind spots.
  • Automated blocking without escalation paths causes operational disruption.
  • Misaligned access rules between zones prevent legitimate operations.
  • Assuming more controls automatically mean better security.
  • Failure to update controls leads to outdated protection layers.
  • Unclear metrics for evaluating effectiveness.
Security architecture and threat modelingNetwork and systems administrationDevOps/SRE practices and automation
Protect critical assetsMinimize attack surfaceMaintain operational availability
  • • Budget and staffing limits
  • • Compliance or regulatory requirements
  • • Technical restrictions in legacy systems