Defense in depth (computing)

Updated 2026-07-29

Defense in depth is a cybersecurity strategy that employs multiple layers of security controls throughout an information technology (IT) system. The core principle is that if one security control fails or a vulnerability is exploited, additional layers of defense continue to provide protection, creating redundancy and slowing the progress of an attack.

Background

The concept originated in military strategy, where layered defenses (e.g., outer perimeter, inner fortifications, fallback positions) make it difficult for an attacker to achieve a decisive breakthrough. In computing, the approach was formally articulated by the U.S. National Security Agency (NSA) as a comprehensive strategy for achieving information assurance in highly networked environments.

Defense in depth is often visualized as an onion model: data sits at the core, surrounded by concentric layers of protection — people, network security, host-based security, and application security. Each layer is independent, so compromising one does not automatically compromise the others.

Three Tiers of Controls

Defense in depth is commonly divided into three overarching categories:

1. Physical Controls

Tangible measures that limit physical access to IT systems. Examples include fences, security guards, guard dogs, locks, biometric scanners, and CCTV surveillance systems.

2. Technical Controls

Hardware and software mechanisms designed to protect systems and resources. These include:

Authentication, authorization, and accounting (AAA) — e.g., multi-factor authentication, role-based access control
Encryption and hashing — protecting data at rest and in transit
Application security — web application firewalls (WAFs), secure coding practices
Host security — vulnerability scanners, sandboxing, endpoint detection and response (EDR), antivirus software
Network security — firewalls, intrusion detection/prevention systems (IDS/IPS), network segmentation, virtual private networks (VPNs)

3. Administrative and Operational Controls

Organizational policies, procedures, and human factors, including:

People — security awareness training, password policies, multi-factor authentication enforcement
Technology — patch management, configuration management
Operations — principle of least privilege, incident response plans, regular audits

Key Principles

Layered redundancy: Multiple independent defenses ensure that a failure in one layer does not lead to total compromise.
Diversity of defense: Using different types of controls (e.g., not relying solely on firewalls) prevents a single attack method from bypassing all layers.
Defense in breadth: Extending security across all dimensions — people, technology, and operations — rather than focusing narrowly on technical controls.

Relationship to Other Models

Defense in depth is conceptually related to the Swiss cheese model of accident causation, where multiple layers (slices of cheese) each have holes (vulnerabilities). An attack succeeds only when holes in all layers align. The goal of defense in depth is to minimize and misalign these holes so that most attacks are stopped by at least one layer.