Stack Your Defences (Defence in Depth)

Why this matters

A single control that 'prevents X' is a single point of failure. Defence in depth stacks controls so any one failing still leaves N-1 in place: kernel hardening, container isolation, network segmentation, audit logging, EDR, monitoring. The art is choosing controls whose failure modes are uncorrelated so an attacker can't bypass them with one trick.

Demo

Stack against unauthorised file read: filesystem permissions (DAC), capabilities/SELinux (MAC), seccomp (syscall filter), audit log (post-hoc detection), EDR (behavioural). One CVE rarely breaks all five.

Try it yourself

1. Map your host's defence stack. Document layers + what each catches.
2. Find one place where two controls have correlated failure modes (e.g. both depend on the same library version). Tighten or replace.
3. Run an authorised attack simulation (Atomic Red Team) and count which layer caught it.

References

• NIST SP 800-160 — Systems Security Engineering
• Atomic Red Team