Defense in depth
noun · also Layered security · NIST CSRC Glossary
Protecting systems with several independent layers of controls, so that when one layer fails, the others still stop or detect the attack.
No single control is perfect. Email filters miss some phishing, users click links, passwords leak and patches arrive late. Defense in depth accepts this and stacks different kinds of protection so that an attacker has to beat several of them in a row: identity controls, endpoint protection, network segmentation, application hardening, data protection, monitoring and recovery.
The layers work best when they are genuinely independent. Two products that rely on the same signal, or the same administrator account, fail together.
Example
A phishing email gets past the mail filter and the user opens the attachment. Attack surface reduction rules block the macro from starting PowerShell; if that failed, the EDR would flag the encoded command; if the payload still ran, segmentation would limit what it could reach; and backups stored offline would allow recovery from ransomware.
Why it matters for a SOC analyst
In an incident review, defense in depth gives you a useful question for each stage of the attack: which layer should have stopped or detected this, and why did it not? Often the answer is a layer that existed but was disabled, misconfigured or not monitored, which makes for concrete, fixable recommendations.
Related terms
- Zero trust
A security model that grants no implicit trust based on network location: every access request is verified, limited and continuously evaluated.
- Network segmentation
Dividing a network into separate zones with controlled traffic between them, so an attacker in one zone cannot freely reach the others.
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- Cyber kill chain
Lockheed Martin's seven-stage model of an intrusion, from reconnaissance to actions on objectives, used to find where an attack can be stopped.