Defense in Depth¶

No single security control is sufficient; redundant layers ensure that failure of one mechanism does not compromise the entire system.

Tension Addressed¶

Defense Depth vs. Complexity

Recognizable As¶

Multiple authentication factors; network segmentation plus application-level access control; input validation at boundary AND internal layers; encryption in transit AND at rest. Any system where security doesn't depend on a single point of protection.

Canonical Sources¶

Saltzer & Schroeder, "The Protection of Information in Computer Systems" (1975); NIST 800-53 Security Controls

Transfers To¶

Physical security (walls + locks + guards), financial controls (dual authorization), safety engineering (redundant systems), quality assurance (multiple testing layers)

Defense in depth acknowledges that attackers have unlimited time and resources to find the one vulnerability in your single defense. Each layer should assume the previous layer has failed.