What is Defense in Depth?

The principle acknowledges that no single security control is foolproof. Firewalls can be misconfigured, EDR agents can be uninstalled or evaded, and users can be socially engineered into handing over credentials. By layering controls so an attacker must defeat multiple independent barriers in sequence, organizations increase the cost and time required for a successful attack and multiply the number of chances defenders get to notice something wrong.

A typical architecture stacks: perimeter controls (NGFW, IPS, WAF) filtering traffic at the network edge, network segmentation dividing the internal network into zones so a compromised workstation cannot reach the domain controller directly, endpoint protection (EDR/AV) watching process execution and file activity, identity controls (MFA, privileged access management) limiting what a stolen credential can do, data protection (encryption at rest and in transit, DLP) making stolen data harder to use, application security (input validation, dependency patching, WAF rules) closing off code-level flaws, and monitoring controls (SIEM, NDR, UEBA) that watch for signs any of the above layers were bypassed. Each layer produces its own logs, and those logs are what a SOC actually works from.

Concretely: an attacker sends a phishing email that gets past the email gateway, the user clicks and a macro downloads a payload, but the EDR agent flags the unusual parent-child process relationship (Word spawning PowerShell) before persistence is established. The NGFW then blocks the outbound C2 callback because the destination IP is on a threat intel blocklist. No single layer stopped the whole chain, but the combination did. This is different from zero trust, which is a specific identity-and-access philosophy (never trust, always verify); defense in depth is the broader architectural pattern that zero trust, segmentation, and layered detection all sit inside.

The same logic applies to detection coverage, not just prevention. No single alert source catches everything: a SIEM correlation rule might miss a novel technique that NDR's behavioral baseline catches, and UEBA might flag account misuse that no signature-based tool would ever see. Combining SIEM correlation, EDR behavioral detection, NDR anomaly analysis, and UEBA risk scoring gives materially higher detection coverage than relying on any single tool, which is why mature SOCs treat 'what layer is missing telemetry here' as a standing architectural question, not a one-time project.