What it means
Defense in depth uses multiple safeguards to reduce the chance that one failure leads directly to serious harm. The layers may prevent entry, restrict what a compromised account can reach, detect misuse, or support recovery. The goal is a reasoned combination of protections with different jobs and failure modes.
Independence matters. Two controls that depend on the same unprotected administrator account may fail together. More tools can also create operational complexity without adding meaningful protection. Start with a realistic harmful scenario, identify how it could progress, and place controls where they can interrupt or limit that progression.
AN ILLUSTRATIVE SCENARIO
A charity finance account
A charity protects its finance application with stronger authentication. It also limits each account's permissions, requires a second person for sensitive payment changes, and reviews unusual activity. If an account session is stolen, authentication alone may no longer block its use, but scoped permissions and transaction approval can still limit damage. Protected records and tested recovery procedures support investigation and restoration. The team checks that the same person cannot quietly disable every layer using the compromised account.
Put it to work
- Describe a credible path from initial failure to business harm, then identify where prevention, restriction, detection, and recovery controls can help.
- Map the dependencies of each layer, including administrative accounts, identity services, logging, and backup access; look for common failure points.
- Exercise a safe scenario in which one layer fails, and verify that the remaining layers produce the expected restriction, alert, or recovery result.
How to check your work
Document what still works when a selected control is unavailable or bypassed in a controlled test. The result should identify remaining protections and dependencies, rather than merely list installed products.
Connect the ideas
- Control
A process, configuration, or technology meant to reduce a named risk or detect a named failure.
- Least privilege
Granting each identity only the actions, objects, and time window required for the current job.
- Residual risk
The risk that remains after selected controls, including the uncertainty you still accept.
- Blast radius
How much additional loss a failure or a response action can cause beyond the original asset.