What does "defense in depth" mean?
Options
- Several independent layers of protection (Correct option)
- One very strong firewall at the network edge
- Hiding the source code of the application
- Using a very long password for each account
Answer
Using several independent layers of protection so that if one fails, others still protect the system
Why
No single control is perfect. Combine layers: input validation, parameterized queries, authentication, authorization, network segmentation, encryption, monitoring, least privilege, and backups.
Example: even if an attacker finds an XSS hole, a Content-Security-Policy and HttpOnly cookies reduce the damage.
Remember
Many layers, so one failure is not fatal.