Security Architecture and Defense in Depth
Why layered defense works
Core concept
Defense in depth assumes that no single control is perfect. By layering identity, network, host, application, and monitoring controls, an organization forces attackers to overcome multiple independent barriers.
Layers of defense
| Layer | Example control |
|---|---|
| People | Security awareness and role-based training |
| Identity | MFA and privileged access management |
| Network | Segmentation and firewall policy |
| Endpoint | Hardening and EDR |
| Application | Secure coding and WAF |
| Monitoring | Centralized logging and alerting |
Prevention, detection, and response
Prevention
- Stops attacks before damage occurs
- Examples: patching, MFA, allowlisting
Detection
- Finds suspicious activity quickly
- Examples: alerts, baselines, correlation
Design principle
Controls should fail safely: when one layer breaks, the next layer should still slow or stop the attack.
How to build layered defenses
-
1
Identify critical assets and threats.
-
2
Choose controls at multiple layers for each major threat.
-
3
Avoid duplicate controls that solve the same problem only once.
-
4
Test whether controls work together under realistic attack paths.
-
5
Review and update the architecture regularly.
What best describes defense in depth?
Defense in depth relies on layered barriers that complement each other.
Correct answer: Multiple overlapping controls across layers
Name one example of a preventive control.
Preventive controls reduce the chance of compromise before it happens.
Correct answer: MFA, patching, or application allowlisting
Which control is primarily detective rather than preventive?
Alerting identifies suspicious behavior after or during it occurs.
Correct answer: Centralized alerting
Why should controls be tested together, not just individually?
Layer interactions matter as much as each control on its own.
Correct answer: Because attackers exploit how systems interact, so combined behavior can create gaps