Defence in Depth

Also Known As

TL;DR

Explanation

Defence in depth is a security principle borrowed from military strategy. No single control is assumed to be perfect — instead, multiple independent layers are applied so that an attacker must defeat all of them. Example: a web app uses prepared statements (layer 1) + WAF (layer 2) + least-privilege database user (layer 3) + monitoring (layer 4). If the WAF is misconfigured, the prepared statements still prevent SQL injection. Each layer should be independent — not relying on other layers having already validated input.

Diagram

flowchart TD
    ATK[Attacker] --> L1[WAF - block known attacks]
    L1 --> L2[Authentication - verify identity]
    L2 --> L3[Authorization - verify permissions]
    L3 --> L4[Input Validation - sanitise data]
    L4 --> L5[Encryption - protect data at rest]
    L5 --> L6[Logging and Monitoring]
    L6 --> L7[Backups - recover from breach]
    INFO[Attacker must defeat every layer]
style ATK fill:#f85149,color:#fff
style L1 fill:#238636,color:#fff
style L7 fill:#238636,color:#fff

Common Misconception

Why It Matters

Common Mistakes

• Relying solely on perimeter defences (firewall, WAF) and having no application-level controls.
• Security layers that are identical rather than independent — the same flaw defeats all layers.
• Not applying defence in depth to data access — assume SQL injection happens and encrypt sensitive columns.
• Treating defence in depth as checkbox compliance rather than genuine layering of independent controls.

Code Examples

// Single layer — WAF as the only defence:
// WAF blocks known SQLi patterns
// But uses string-concatenated queries directly
// WAF bypass → direct database access
// Better: WAF + parameterised queries + least-privilege DB user + encrypted columns

// Multiple independent layers — each one fails safely
// Layer 1 — WAF blocks obvious attacks at CDN edge
// Layer 2 — Rate limiting at load balancer
// Layer 3 — Authentication middleware
// Layer 4 — Authorisation check in controller
// Layer 5 — Input validation in Form Request
// Layer 6 — Prepared statements — SQL injection impossible even if validation bypassed
// Layer 7 — Output encoding — XSS impossible even if data is tainted
// Layer 8 — CSP headers — XSS payload can't exfiltrate even if rendered

// In code — don't rely on a single guard:
public function update(Request \$req, int \$id): JsonResponse {
    \$req->validate(['name' => 'required|string|max:100']); // L5
    \$user = User::findOrFail(\$id);
    if (\$user->id !== auth()->id()) abort(403);             // L4
    \$user->update(['name' => \$req->name]);                 // L6 (Eloquent uses PDO)
    return response()->json(['name' => e(\$user->name)]);   // L7
}

References

• ↗ https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

Tags

Related Terms