Defense In Depth
Defense in Depth & Security Controls 🔒🏰¶
🔹 What is Defense in Depth (DiD)?¶
Defense in Depth (DiD) is a layered security approach where multiple security controls protect against cyber threats. If one layer fails, others continue to protect the system.
1️⃣ Layers of Defense in Depth & Security Controls¶
| Layer | Example Controls | Security Control Type |
|---|---|---|
| Physical Security | AWS Data Centers, SOC Compliance | Preventive |
| Network Security | Firewalls, VPC, Security Groups, AWS Shield | Preventive, Detective |
| IAM & Access Control | MFA, Least Privilege, IAM Roles | Preventive |
| Endpoint Security | GuardDuty, Systems Manager, Antivirus | Preventive, Detective |
| Application Security | WAF, API Gateway, Secure Coding | Preventive, Detective |
| Data Security | Encryption, Backups, RDS Snapshots | Preventive, Corrective |
| Monitoring & Response | CloudTrail, SIEM, Incident Response Plans | Detective, Corrective |
2️⃣ Types of Security Controls in Defense in Depth¶
🔹 Preventive Controls – Stop threats before they happen.
➡ MFA, Firewalls, Least Privilege (PoLP), Endpoint Security.
🔹 Detective Controls – Identify security incidents.
➡ SIEM, Intrusion Detection Systems (IDS), Audit Logs.
🔹 Corrective Controls – Mitigate and respond to attacks.
➡ Incident Response, Backups, Patching.
🔹 Deterrent Controls – Discourage attackers.
➡ Security Awareness Training, Legal Policies.
🔹 Compensating Controls – Alternative controls when primary security fails.
➡ Extra monitoring if MFA isn’t available.
3️⃣ Real-World Example: AWS Cloud Security Implementation ☁️¶
🔹 Physical Security (Preventive Control)¶
✅ AWS secures data centers with biometric access, surveillance, and armed guards.
🔹 Network Security (Preventive & Detective Controls)¶
✅ VPC (Virtual Private Cloud) – Isolates environments.
✅ Security Groups & NACLs – Control inbound/outbound traffic.
✅ AWS Shield – Protects against DDoS attacks.
🔹 IAM & Access Management (Preventive Control)¶
✅ IAM Policies & Roles – Enforce Least Privilege (PoLP).
✅ MFA (Multi-Factor Authentication) – Prevent unauthorized access.
🔹 Endpoint Security (Preventive & Detective Controls)¶
✅ Amazon GuardDuty – Detects threats in real time.
✅ AWS Systems Manager (SSM) – Patches EC2 instances.
✅ Bastion Host – Restricts direct SSH access.
🔹 Application Security (Preventive & Detective Controls)¶
✅ AWS WAF (Web Application Firewall) – Blocks SQL Injection, XSS.
✅ API Gateway + IAM Authorization – Secures API endpoints.
✅ Code Scanning (CI/CD) – Detects vulnerabilities.
🔹 Data Security (Preventive & Corrective Controls)¶
✅ S3 Encryption (AES-256, KMS) – Secures stored data.
✅ Database Encryption (RDS, DynamoDB) – Protects sensitive records.
✅ Backups & Snapshots (AWS Backup, RDS Snapshots) – Ensures disaster recovery.
🔹 Monitoring & Incident Response (Detective & Corrective Controls)¶
✅ AWS CloudTrail – Logs all API activity.
✅ Amazon CloudWatch + Alerts – Detects system anomalies.
✅ SIEM (AWS Security Hub, Splunk, ELK Stack) – Centralized threat detection.
✅ Incident Response Playbooks – Automate security actions.
4️⃣ How Defense in Depth & Security Controls Work Together¶
✔ Defense in Depth applies multiple security layers to protect systems.
✔ Security controls ensure protection at every layer.
✔ Combining DiD + Security Controls strengthens security in Cloud, DevOps, and IT environments.