Also known as: layered security · defence in depth
Defense in depth is a security strategy that layers multiple independent controls so that the failure or bypass of any single control does not result in compromise.
The reasoning is probabilistic: every individual control has a failure rate, and independent layers multiply the difficulty of a successful end-to-end attack. A phishing-resistant login, a segmented network, least-privilege service accounts, and monitored egress each fail differently.
The important qualifier is independence. Layers that share an assumption fail together — three controls all relying on the same identity provider are one control wearing three hats.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.
Principle of Least Privilege
The principle of least privilege holds that every user, process, and system should be granted only the minimum permissions necessary to perform its function, and no more.
Microsegmentation
Microsegmentation is the practice of dividing a network into small isolated zones with explicit policies governing traffic between them, so that a compromised system cannot freely communicate with unrelated systems.
Incident Response
Incident response is the structured process an organisation follows to detect, contain, eradicate, and recover from a security incident, and to learn from it afterwards.