Defence in depth
defense in depth · layered security · layered defence · multi-layer security · défense en profondeur
A strategy that stacks several independent layers of protection, so that when one fails, the others make up for it.
In practice
No single control is perfect: a spam filter lets a malicious email through, a user clicks, an antivirus misses a new variant. Defence in depth starts from that reality and stacks barriers of different kinds (human, technical, organisational), then plans detection and response for the day everything else has failed. Borrowed from the art of fortification, the idea has become a reference principle for information systems at ANSSI, France’s cybersecurity agency.
Fictional case: a malicious email gets past filtering. The link leads to a page blocked by the web proxy; had it not been, multi-factor authentication would make the stolen password useless; failing that, the EDR would spot the abnormal activity, and offline backups would allow a clean restart.
