Defence in Depth
5 exercises — master defence-in-depth vocabulary: layered security architecture, preventive / detective / corrective control classification, WAF vs application-layer limits, complete logging pipeline requirements, and the cloud shared responsibility model.
0 / 5 completed
Defence in depth quick reference
- Defence in depth — multiple, independent, overlapping controls; attacker must defeat every layer. No single control is sufficient.
- Layers — Perimeter (firewall/WAF) → Host (OS hardening/EDR) → Application (auth/input validation) → Data (encryption/least privilege) → Detective (SIEM/logs) → Corrective (IR/backups).
- Preventive — stops attacks: auth, rate limiting, parameterised queries, WAF.
- Detective — identifies attacks: SIEM, audit logs, anomaly detection, IDS. Requires: structured logs + immutable storage + alert rules + response playbook.
- Corrective — limits damage, restores service: account lockout, circuit breaker, backup restoration, IR plan.
- WAF limitation — covers known signatures; cannot replace application-level input validation, CSRF protection, IDOR checks, or business logic validation.
- Shared responsibility — CSP = infrastructure security; Customer = IAM, application, data encryption, configuration, logging, IR.
1 / 5
A CISO presents the company's security strategy and says: "Our primary architectural principle is defence in depth. This means we don't rely on any single control — we have multiple overlapping layers."
What does this mean in practice, and why is it necessary?
Defence in depth — the principle that security controls must overlap because any single control can fail or be bypassed. The attacker must defeat all layers, not just one.
Classic defence-in-depth layers for a web application:
Why single controls fail:
• WAF: rules based on known attack signatures; novel zero-day techniques bypass rules
• Authentication: even strong auth can be bypassed by session fixation, account takeover, or social engineering
• Encryption: protects data at rest; useless if the attacker has valid credentials to the DB
• Input validation: application-layer logic can have edge cases; parameterised queries act as a second layer
Defence in depth vs security theatre:
Layers must be independent and genuinely add security. Adding a second signature-based WAF with identical rules is not defence in depth — one successful bypass defeats both. True depth: a WAF (signature-based) + application input validation (semantic-based) + parameterised queries (structural) — three independent mechanisms that an attacker must defeat differently.
Key vocabulary:
• Defence in depth — multiple, independent, overlapping security controls from different categories; attacker must bypass all layers
• Preventive control — a control that stops an attack from succeeding: firewall, authentication, input validation, WAF
• Detective control — a control that identifies when an attack has occurred or is occurring: SIEM, audit logs, anomaly detection, IDS
• Corrective / response control — a control that limits damage or restores service after an attack: IR plan, backups, isolation procedures
Classic defence-in-depth layers for a web application:
| Layer | Controls | What it stops |
|---|---|---|
| Perimeter / network | Firewall, WAF, DDoS mitigation, CDN | Port scans, volumetric DDoS, known exploit signatures |
| Host / endpoint | OS hardening, patch management, EDR, read-only filesystems | OS vulnerabilities, malware, privilege escalation |
| Application | Authentication, authorisation, input validation, CSRF protection | Injection, broken auth, privilege escalation |
| Data | Encryption at rest, encryption in transit, least privilege, backups | Data theft, ransomware, insider threats |
| Detective | SIEM, audit logging, anomaly detection, IDS | Catches attacks bypassing preventive controls; enables response |
| Response | IR plan, backups, runbooks, tabletop exercises | Limits damage when attacks succeed; provides recovery path |
Why single controls fail:
• WAF: rules based on known attack signatures; novel zero-day techniques bypass rules
• Authentication: even strong auth can be bypassed by session fixation, account takeover, or social engineering
• Encryption: protects data at rest; useless if the attacker has valid credentials to the DB
• Input validation: application-layer logic can have edge cases; parameterised queries act as a second layer
Defence in depth vs security theatre:
Layers must be independent and genuinely add security. Adding a second signature-based WAF with identical rules is not defence in depth — one successful bypass defeats both. True depth: a WAF (signature-based) + application input validation (semantic-based) + parameterised queries (structural) — three independent mechanisms that an attacker must defeat differently.
Key vocabulary:
• Defence in depth — multiple, independent, overlapping security controls from different categories; attacker must bypass all layers
• Preventive control — a control that stops an attack from succeeding: firewall, authentication, input validation, WAF
• Detective control — a control that identifies when an attack has occurred or is occurring: SIEM, audit logs, anomaly detection, IDS
• Corrective / response control — a control that limits damage or restores service after an attack: IR plan, backups, isolation procedures