~/moritzsamrock_

Defense in Depth

Also known as:DiD

Defense in Depth: Combines multiple independent security controlsSecurity ControlA technical, organizational, or physical measure used to reduce a security risk. to create layered protection. This concept shapes the security architectureSecurity ArchitectureThe structured design of security controls, trust boundaries, data flows, and operational responsibilities. and systematically reduces opportunities for attack or lateral movement. It should be planned based on risk, documented, tested, and regularly adjusted.

How it works and where it fits

Defense in Depth is a building block of security architecture that must be understood in its system and business context. Its intended objective, affected trust boundaries, prerequisites, and interaction with other controls are decisive. An isolated definition is therefore not sufficient for implementation or assessment.

Practical security relevance

Sound implementation assigns ownership, configuration, data sources, and verifiable success criteria. Assumptions and exceptions should be documented and changes controlled. Periodic testing shows whether the concept reduces risk in the actual environment or has merely been addressed as a formal requirement.

  • Zero TrustZero TrustSecurity model that grants no implicit trust and verifies every request based on context.: Security model that grants no implicit trust and verifies every request based on context.
  • Network SegmentationNetwork SegmentationSeparates network segments to control access and limit lateral movement.: Separates network segments to control access and limit lateral movement.
  • Compensating ControlCompensating ControlCompensating measure that reduces risk when a primary control is not feasible.: Compensating measure that reduces risk when a primary control is not feasible.
  • Fail-Safe DefaultsFail-Safe DefaultsPrinciple whereby access is denied by default and granted only when explicitly permitted.: Principle whereby access is denied by default and granted only when explicitly permitted.

Related terms