Dictionary · Cybersecurity Fundamentals
Defense in Depth
Design · Beginner
Using multiple, independent layers of protection so the failure of one control does not automatically expose the whole environment.
A firewall, patched software, limited accounts, and monitored logs protect different failure modes. The point is that one missed control is not the entire defense.
Picture it
A filter, limited accounts, patched software, and monitoring fail in different ways. One missed control should not expose the whole environment.
Example: Even if a phishing message gets through the mail filter, limited privileges and monitoring can still contain the damage.
Common misconception
- Adding more tools without a purpose is not this principle. The layers need to fail in different ways.