Defense in depth, also called security in layers, protects an organization through multiple security practices rather than relying on one control. For developers, the layers include application security, data protection, and access management alongside physical and network security. section 3.5
In containerized applications, practical layers include:
- Run containers as read-only where possible to limit malicious changes after compromise. section 3.5
- Constrain memory and CPU so one container cannot consume resources needed by the wider system. section 3.5
- Use no-new-privileges to prevent applications from gaining additional privileges or root access. section 3.5
- Encrypt and mask sensitive data, then authenticate and authorize users. section 3.5
