Defense in depth
Defense in depth is a security strategy that combines multiple protective controls so that the failure or compromise of one does not eliminate all protection.
Financial AI in Practice
Defense in depth layers distinct protective controls so that one control can compensate for another's failure or limitations.
- How it is used
- Separates fast transaction blocking, deeper fraud investigation, and customer-facing response controls so financial AI does not rely on one model.
- How deep it goes
- Explains the roles and ordering of layers, including output checks and human approval, but provides no implementation code.
- Examples
- Contrasts real-time transaction blocking with asynchronous alert summaries and uses financial advice to illustrate mandatory human approval.
- What you can do after
- Evaluate/understand it by assigning controls to tasks according to latency, risk, explainability, and investigation needs.
Read how Financial AI in Practice explains defense in depth →
Real-World Cryptography
A defense-in-depth technique is a security measure that adds an independent protective layer to reduce the impact of failures or compromises.
- How it is used
- Reduces the impact of failures or compromises by making attackers defeat multiple imperfect protections.
- How deep it goes
- Defines layering through password, web, and hardware examples, but stops short of prescribing one universal defense stack.
- Examples
- Uses hashed passwords, certificate revocation, OCSP stapling, Certificate Transparency, skimmers, evil maid attacks, and hardware key isolation.
- What you can do after
- Evaluate security designs by identifying independent layers and estimating how each raises an attacker’s cost.
Read how Real-World Cryptography explains defense in depth →
MongoDB 8.0 in Action, Third Edition
Defense in depth is a security strategy that layers multiple independent defensive mechanisms so that one breached control does not expose an entire system.
- How it is used
- Protects Atlas data and infrastructure when one security control is bypassed.
- How deep it goes
- Defines the strategy and gives configuration choices across network access, identity, permissions, and encryption, without a step-by-step setup.
- Examples
- Uses IP access lists, private endpoints, federated SSO, SCRAM or X.509, and encryption options as Atlas controls.
- What you can do after
- Operate/configure Atlas with complementary network, access, and encryption controls so one failed control is not the only barrier.
Read how MongoDB 8.0 in Action, Third Edition explains defense in depth →
Microsoft Azure in Action
Defense in depth is a security pattern that applies multiple independent protective layers so that failure of one control does not expose the entire system.
- How it is used
- Frames Azure security as multiple protections for data rather than one feature to enable.
- How deep it goes
- Defines the layered approach and names seven Azure layers, but stops short of product-by-product security configuration.
- Examples
- Uses a seven-barrier castle analogy and restricted data-center entry to make layered protection concrete.
- What you can do after
- Evaluate/understand Azure security as seven layers protecting data, while recognizing that some security choices still require configuration.
Read how Microsoft Azure in Action explains defense in depth →
Kubernetes for Developers
Defense in depth is a security strategy that layers multiple independent protections so that failure of one protection does not compromise the entire system.
- How it is used
- Protects Kubernetes workloads by adding non-root execution to container isolation.
- How deep it goes
- Explains three defense layers and works through identity, permissions, ports, and service configuration.
- Examples
- Uses Kubernetes manifests, Dockerfile USER settings, port 8080 migration, and permission-related pod failures.
- What you can do after
- Operate containers with non-root identities and diagnose resulting startup, port, and filesystem permission errors.
Read how Kubernetes for Developers explains defense in depth →
Azure Security
A security strategy that combines multiple independent layers of protection so that each layer increases attack difficulty and compensates when another layer fails.
- How it is used
- Reduces breach likelihood by layering Azure controls across workload security, threat detection, investigation, and response.
- How deep it goes
- Explains layered protection, failure compensation, and threat progression without detailing individual service configuration.
- Examples
- Uses a soccer defense analogy and diagrams Azure resource types and security services protecting applications and data.
- What you can do after
- Apply layered Azure security controls across resources, attack stages, monitoring, detection, investigation, and response.
Build Financial Software with Generative AI (From Scratch)
Defense in depth is a security strategy that uses multiple independent layers of protection across physical, network, application, data, and access controls.
- How it is used
- Applies layered protections across containers, applications, data, users, networks, and physical infrastructure.
- How deep it goes
- Explains the principle and demonstrates container controls, while stopping short of a full security architecture.
- Examples
- Uses read-only containers, resource limits, no-new-privileges, encryption, data masking, authentication, and authorization.
- What you can do after
- Apply layered container controls and identify complementary application, data, and access protections.
Read how Build Financial Software with Generative AI (From Scratch) explains defense in depth →
Related concepts
- guardrailuses · A guardrail is a constraint, safeguard, or control that limits actions or behavior to reduce risk and keep a system or process within acceptable bounds.
- revocationhas part · Revocation is the invalidation or withdrawal of a previously issued credential, key, certificate, token, or permission before or when its authorization ends.
- non-root containeruses · A non-root container is a container whose processes run under a user identity other than the operating-system root user.
- evaluatoruses · An evaluator is a model or component that assesses outputs against specified criteria and produces judgments, scores, comparisons, or feedback.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.