Defense in Depth

What is it?

Defense in depth means using multiple, independent layers of security controls so that if one layer fails or is bypassed, another layer can still stop or detect the threat. No single control is trusted to be perfect.

Why should I learn it?

Companies design networks assuming any one control can fail. A junior engineer who only understands “add a firewall rule” misses how segmentation, logging and access control work together as a system.

How it works

Perimeter control (firewall/VPN) → internal segmentation (VLANs/ACLs) → host-level control (endpoint protection) → monitoring/logging (detects what got through) → response process.

Real-world example

If an attacker bypasses the perimeter firewall through a phishing email, network segmentation can still stop them from reaching the finance VLAN, and logging can still reveal the intrusion.

Troubleshooting mindset

If one control fails, check whether the next layer caught the issue before assuming the whole network is compromised.

Common mistake

Do not memorise the definition without connecting it to packet flow, device state and verification. Ask: what should happen, what actually happened, and which command or capture can prove the difference?

Quick recap

• Understand the job of the protocol or feature.
• Know where it sits in the traffic path.
• Verify behaviour instead of guessing.
• Connect the topic to the next networking layer.

Interview connection

Explain the concept in simple words first. Then give one practical example or troubleshooting check. That is stronger than repeating a textbook definition.

References & Further Reading

• AddySec original content — written for the Network Security track to build practical, interview-ready understanding.