Defence in depth — the layer cake

Why this matters

A single control that 'prevents X' is a single point of failure. Defence in depth stacks controls so any one failing still leaves N-1 in place: kernel hardening, container isolation, network segmentation, audit logging, EDR, monitoring. The art is choosing controls whose failure modes are uncorrelated so an attacker can't bypass them with one trick.

Demo

Stack against unauthorised file read: filesystem permissions (DAC), capabilities/SELinux (MAC), seccomp (syscall filter), audit log (post-hoc detection), EDR (behavioural). One CVE rarely breaks all five.

Try it yourself

1. Map your host's defence stack. Document layers + what each catches.
2. Find one place where two controls have correlated failure modes (e.g. both depend on the same library version). Tighten or replace.
3. Run an authorised attack simulation (Atomic Red Team) and count which layer caught it.

Prompt your AI

Use these three in order. Each builds on the one before.

1. Basics & terminology

In one paragraph, explain defence in depth.

2. Why it works (the mechanism)

Walk me through five orthogonal controls against a single attack class.

3. Advanced — application & what's next

When does adding another defence-in-depth layer become net-negative (operationally too expensive)?

References

• NIST SP 800-160 — Systems Security Engineering
• Atomic Red Team