Defense in Depth

Medieval castle builders understood something that many software architects forget: a single wall is not enough. Castles had moats, outer walls, inner walls, towers, and a keep. An attacker who crossed the moat still faced the outer wall. Breaching the outer wall revealed the inner wall. Each layer slowed the attack and gave defenders time to respond.

Defense in depth applies this principle to software. No single security control is perfect. Firewalls have vulnerabilities. Authentication can be bypassed. Encryption can be misconfigured. But when you layer multiple independent controls, an attacker must defeat all of them to reach your assets.

The 2013 Target breach illustrates what happens without layered defense. Attackers entered through an HVAC vendor's compromised credentials. Once past the perimeter, nothing stopped lateral movement to the payment processing network. A second layer (network segmentation) would have blocked access to cardholder data. A third layer (anomaly detection) would have flagged the unusual data transfers to a staging server. A fourth layer (egress filtering) would have blocked the exfiltration. Any single additional layer would have contained the breach. They had none.

40 million credit card numbers were stolen. The CEO and CIO resigned. The total cost exceeded $200 million.

Defense in depth is not "add more firewalls." Each layer addresses a different class of threat with a different type of control.

Each layer operates independently. The WAF does not rely on the firewall. The application does not rely on the WAF. The database encryption does not rely on the application. If any single layer fails, the remaining layers still provide protection.