Implementing Defense in Depth

Quick Start

Perimeter - WAF, DDoS protection, rate limiting, IP filtering
Network - VPC, security groups, mTLS, network policies
Application - Input validation, output encoding, CSRF, CSP
Data - Encryption at rest/transit, access control, classification
Identity - MFA, least privilege, session management
Monitoring - Logging, alerting, anomaly detection across all layers

Features

Feature	Description	Guide
Layered Protection	5+ independent security barriers	Each layer catches what others miss
Perimeter Security	First line of defense	WAF rules, rate limits, DDoS protection
Network Isolation	Segment and protect internal comms	VPC subnets, security groups, mTLS
Application Security	Secure code and request handling	Validate input, encode output, CSP headers
Data Protection	Protect data at rest and in transit	AES-256-GCM, field-level encryption
Identity Security	Authentication and authorization	MFA, RBAC, secure sessions

Common Patterns

# Security Layers Architecture
+--------------------------------------------------+
| LAYER 1: PERIMETER                               |
| WAF | DDoS | Rate Limiting | IP Filtering        |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 2: NETWORK                                 |
| VPC | Security Groups | TLS Everywhere           |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 3: APPLICATION                             |
| Input Validation | Output Encoding | CSRF | CSP  |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 4: DATA                                    |
| Encryption at Rest | Encryption in Transit       |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 5: IDENTITY                                |
| MFA | Least Privilege | Session Management       |
+--------------------------------------------------+

CROSS-CUTTING: Logging | Alerting | Anomaly Detection

# Network Security Groups (Example)
loadBalancer:
  inbound:  [443 from 0.0.0.0/0]
  outbound: [8080 to application-sg]

application:
  inbound:  [8080 from load-balancer-sg]
  outbound: [5432 to database-sg, 443 to external]

database:
  inbound:  [5432 from application-sg]
  outbound: [] # No outbound

Best Practices

Do	Avoid
Implement all layers - each provides unique protection	Relying on a single security layer
Fail securely - deny access when in doubt	Trusting user input at any layer
Log security events for detection/forensics	Exposing detailed error messages
Rotate credentials regularly	Storing secrets in code
Validate all inputs at every layer	Skipping security in development
Encrypt sensitive data at rest and in transit	Assuming internal traffic is safe
Use least privilege for all access	Disabling security for "convenience"
Test security controls regularly	Ignoring security alerts

Related Skills

applying-owasp-security - OWASP security guidelines
implementing-oauth - OAuth authentication flows
implementing-better-auth - Modern auth patterns
verifying-before-completion - Security verification checklists

implementing-defense-in-depth

Implementing Defense in Depth

Quick Start

Features

Common Patterns

Best Practices

Related Skills