# What is Defense in Depth?

> Defense in depth is a security strategy that uses multiple layers of people, process, architectural, and technical controls so that one failure does not expose the entire system.

- Canonical URL: https://yellowcube.eu/glossary/defense-in-depth/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The layers should prevent some attacks, reveal others, limit their movement or impact, and support recovery.

Effective depth comes from complementary and reasonably independent safeguards. Repeating the same control in several places can create the appearance of protection while preserving a common failure mode — for example, several tools that all depend on the same identity system, telemetry source, or mistaken policy.

Real depth also spans functions, not just vendors: prevention buys time, detection notices the failure, response limits the spread, and recovery restores service. Exercises that deliberately bypass one layer — a missed alert, a phished credential — reveal whether the remaining layers genuinely compensate or quietly share the same assumptions.

### Key points

- **Possible layers:** Secure design, identity controls, hardened endpoints, segmentation, monitoring, response, protected backups, and exercised recovery.
- **Design principle:** Assume individual safeguards can be bypassed, misconfigured, unavailable, or compromised.
- **Validation need:** Test whether layers have sufficiently independent failure modes and whether detection and recovery still work after a preventive control fails.
- **Important limitation:** Excessive layering can increase complexity, obscure ownership, and create new failure paths; every layer needs a defined purpose.

### Related terms

[Cybersecurity](<https://yellowcube.eu/glossary/cybersecurity/>) · [Zero trust architecture (ZTA)](<https://yellowcube.eu/glossary/zero-trust-architecture/>) · [Network segmentation](<https://yellowcube.eu/glossary/network-segmentation/>) · [Cyber resilience](<https://yellowcube.eu/glossary/cyber-resilience/>) · [Security architecture](<https://yellowcube.eu/glossary/security-architecture/>) · [Operational security (OPSEC)](<https://yellowcube.eu/glossary/operational-security/>)

### Sources

[NIST glossary: Defense in Depth](https://csrc.nist.gov/glossary/term/defense_in_depth) · [NIST SP 800-53r5: Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.