security//defense in depth

Defense in depth is a security strategy that stacks independent or partially independent controls so that one failure does not directly become catastrophe. Identity policy, sandboxing, network restrictions, monitoring, approvals, backups and incident response cover different failure modes: a sandbox limits execution while other layers govern identity, network reach and recovery, and behavioral detection compensates when prevention fails or an action was technically authorized.

Defense in depth is a security strategy that stacks independent or partially independent controls so that one failure does not directly become catastrophe. Identity policy, sandboxing, network restrictions, monitoring, approvals, backups and incident response cover different failure modes: a sandbox limits execution while other layers govern identity, network reach and recovery, and behavioral detection compensates when prevention fails or an action was technically authorized.

The word independent does the real work. Five controls that all trust the same compromised credential are one control drawn five times. Layers should fail differently and leave evidence for the next layer to notice.

Security is rarely a perfect wall. It is a sequence of inconvenient rooms with alarms between them.