Defense in Depth

Layering multiple independent security controls so no single failure compromises the whole system.

What it is

Defense in depth layers multiple, independent security controls so that if one fails, others still protect the system — no single point of failure in the security posture itself.

Key points

Layers typically span network (firewalls, segmentation), application (input validation, authZ checks), data (encryption at rest/in transit), and organizational (training, process) controls.
The goal isn't redundancy for its own sake — each layer should address a different failure mode, not just repeat the same check.
This is the architectural counterpart to "assume breach": design as if any single control will eventually fail, and make sure that's survivable.
Cost and complexity scale with each added layer, so defense in depth is applied proportionally to what's actually at risk, not uniformly everywhere.