.NET Architecture & System Design Interview Question #154

What is defense in depth?

Security Architecture, Multi-Tenancy & Disaster Recovery Senior Advanced

Quick Interview Answer

Defense in depth uses multiple independent security controls so failure of one control does not automatically expose the entire system.

Detailed Explanation

Defense in depth uses multiple independent security controls so failure of one control does not automatically expose the entire system.

A web application might combine authentication, authorization, input validation, secure secrets, network restrictions, encryption, monitoring, and database permissions. The goal is layered risk reduction rather than dependence on one perimeter control.

Code Example

Internet
  -> WAF / edge controls
  -> Authentication
  -> Authorization
  -> Application validation
  -> Restricted data access
  -> Monitoring / audit