2.1.2. Defense-in-Depth
💡 First Principle: No single security control is perfect, so defense-in-depth stacks multiple independent layers of protection — physical, identity, perimeter, network, compute, application, and data — so that if an attacker defeats one layer, several more stand between them and the actual data.
Picture a castle: a moat, then a wall, then guards, then a locked inner keep, then a vault. Defeating the moat doesn't get you the treasure — you still face the wall, the guards, and the vault. Cloud security works the same way. Physical security protects the datacenter itself; identity and access controls verify who's asking; perimeter controls (Phase 4) filter traffic at the edge; network controls segment traffic internally; compute controls harden the VM or container; application controls validate input and code; and data controls (encryption, classification) protect the information itself even if every other layer is somehow bypassed.
⚠️ Exam Trap: A single well-configured firewall is not defense-in-depth — the term specifically requires multiple, independent layers, so that no single point of failure exposes everything.
Reflection Question: If an attacker steals a valid employee password (bypassing the identity layer), which remaining layers of defense-in-depth could still stop them from reaching sensitive data?
