Defense in Depth

Kind: principle

Layer: Security Core

Record: architecture:defense-in-depth

Severity: mandatory

Scope: system, infrastructure, application

Canonical: Ontology

A design rule that several independent security controls protect each asset, so one failed control does not expose it.

Listed in Architecture principles, after Security by Design and before Least Privilege.

Requires

• Layered Controls

Reinforces

• Security by Design

Enables

• Compromise Containment

Conflicts with

• Single Control Reliance

In tension with

• Complexity

Tensions

• Defense in Depth / Complexity

Violated by

• Single Control Reliance

Refactored by

• Controls

Severity

• mandatory

Category

• Security / Privacy / Compliance / Governance

Reinforced by

• CSRF Protection

Linked from

• Security / Privacy / Compliance / Governance
• Quality Attributes
• Security Privacy Compliance
• Severity levels
• The resolutions