---
name: implementing-defense-in-depth
description: AI agent designs layered security architecture with multiple independent protective barriers ensuring no single point of failure. Use when building security systems, reviewing architecture, or hardening applications.
---

# Implementing Defense in Depth

## Quick Start

1. **Perimeter** - WAF, DDoS protection, rate limiting, IP filtering
2. **Network** - VPC, security groups, mTLS, network policies
3. **Application** - Input validation, output encoding, CSRF, CSP
4. **Data** - Encryption at rest/transit, access control, classification
5. **Identity** - MFA, least privilege, session management
6. **Monitoring** - Logging, alerting, anomaly detection across all layers

## Features

| Feature | Description | Guide |
|---------|-------------|-------|
| Layered Protection | 5+ independent security barriers | Each layer catches what others miss |
| Perimeter Security | First line of defense | WAF rules, rate limits, DDoS protection |
| Network Isolation | Segment and protect internal comms | VPC subnets, security groups, mTLS |
| Application Security | Secure code and request handling | Validate input, encode output, CSP headers |
| Data Protection | Protect data at rest and in transit | AES-256-GCM, field-level encryption |
| Identity Security | Authentication and authorization | MFA, RBAC, secure sessions |

## Common Patterns

```
# Security Layers Architecture
+--------------------------------------------------+
| LAYER 1: PERIMETER                               |
| WAF | DDoS | Rate Limiting | IP Filtering        |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 2: NETWORK                                 |
| VPC | Security Groups | TLS Everywhere           |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 3: APPLICATION                             |
| Input Validation | Output Encoding | CSRF | CSP  |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 4: DATA                                    |
| Encryption at Rest | Encryption in Transit       |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 5: IDENTITY                                |
| MFA | Least Privilege | Session Management       |
+--------------------------------------------------+

CROSS-CUTTING: Logging | Alerting | Anomaly Detection
```

```
# Network Security Groups (Example)
loadBalancer:
  inbound:  [443 from 0.0.0.0/0]
  outbound: [8080 to application-sg]

application:
  inbound:  [8080 from load-balancer-sg]
  outbound: [5432 to database-sg, 443 to external]

database:
  inbound:  [5432 from application-sg]
  outbound: [] # No outbound
```

## Best Practices

| Do | Avoid |
|----|-------|
| Implement all layers - each provides unique protection | Relying on a single security layer |
| Fail securely - deny access when in doubt | Trusting user input at any layer |
| Log security events for detection/forensics | Exposing detailed error messages |
| Rotate credentials regularly | Storing secrets in code |
| Validate all inputs at every layer | Skipping security in development |
| Encrypt sensitive data at rest and in transit | Assuming internal traffic is safe |
| Use least privilege for all access | Disabling security for "convenience" |
| Test security controls regularly | Ignoring security alerts |

## Related Skills

- `applying-owasp-security` - OWASP security guidelines
- `implementing-oauth` - OAuth authentication flows
- `implementing-better-auth` - Modern auth patterns
- `verifying-before-completion` - Security verification checklists