Defense in depth and the weakest link

Every control in this track can fail. Keys leak, policies are misconfigured, enclaves have side channels, and people approve things they should not. Defense in depth is the design response: assume any one layer fails, and arrange the others so that failure is survivable rather than total.

It is easy to say and easy to fake. Three layers that all depend on the same assumption are one layer wearing three hats.

• Independent layers fail for different reasons. A network control and a cryptographic control are genuinely independent; two network controls from the same vendor largely are not.
• Each layer should be individually meaningful. A control that only helps when another has already failed is a fallback, and worth having, but do not count it twice.
• Layers must not create a false sense of coverage. The most common harm from a weak layer is the stronger control that never got built because someone believed the problem was handled.

Three older principles are worth knowing by name, because they are what the layering is made of.

• Complete mediation. Every access is checked, every time, with no cached or implicit approval. A system that authorises once and then trusts a session indefinitely has a hole that widens with the session's lifetime.
• Separation of duties. No single principal can complete a sensitive action alone. It is why a human approves what an agent proposes, and why the person who writes a policy should not be the only one who can approve widening it.
• The weakest link. Attackers do not attack your strongest control; they go around it. Effort spent hardening something already strong is usually effort not spent on the part that will actually be attacked.

There is a real cost to layering, and pretending otherwise is how security teams lose credibility. Each layer adds latency, failure modes and operational burden, and a system with enough layers becomes one nobody fully understands. That is its own risk.

• Prefer few strong, independent layers to many weak, correlated ones.
• Every layer should have an owner who can explain what it stops and what it costs.
• A layer nobody monitors is decorative; if its failure would be silent, it is not defending anything.