<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-defense-in-depth
description: >-
  Implement defense-in-depth strategies with layered security controls across
  perimeter, network, endpoint, application, data, identity, and operational layers
  with preventive, detective, and corrective controls at each tier.
domain: cybersecurity
subdomain: security-architecture
tags:
  - defense-in-depth
  - layered-security
  - compensating-controls
  - cis-controls
  - nist-csf
  - security-layers
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Implementing Defense-in-Depth

## Overview

Defense-in-depth ensures no single control failure compromises the entire system.
This skill covers designing and implementing layered security controls across seven
tiers, mapping controls to frameworks (CIS, NIST CSF), and validating coverage
through gap analysis.

Mode: `[MODE: ARCHITECT]` — Layered security design.

## Prerequisites

| Requirement | Details |
|---|---|
| System architecture documentation | Required |
| CIS Controls v8 and NIST CSF references | Required |
| Access to network, endpoint, and application control planes | Required |
| Python 3.10+ | Required |

## Key Concepts

### Seven Layers of Defense

```
┌─────────────────────────────────────────┐
│  Layer 7: Operations & Governance       │  Policies, training, IR, audits
├─────────────────────────────────────────┤
│  Layer 6: Identity & Access             │  MFA, RBAC, PAM, SSO
├─────────────────────────────────────────┤
│  Layer 5: Data Protection               │  Encryption, DLP, classification
├─────────────────────────────────────────┤
│  Layer 4: Application Security          │  WAF, SAST/DAST, input validation
├─────────────────────────────────────────┤
│  Layer 3: Endpoint Security             │  EDR, AV, disk encryption, patching
├─────────────────────────────────────────┤
│  Layer 2: Network Security              │  Firewalls, IDS/IPS, segmentation
├─────────────────────────────────────────┤
│  Layer 1: Physical / Perimeter          │  DDoS protection, CDN, access control
└─────────────────────────────────────────┘
```

### Control Types Per Layer

```yaml
perimeter:
  preventive:
    - DDoS mitigation (CloudFlare, AWS Shield)
    - Geo-blocking and IP reputation filtering
    - CDN with edge WAF
  detective:
    - NetFlow analysis for volumetric anomalies
    - DNS query monitoring
  corrective:
    - Automated IP blocklisting
    - Traffic rerouting via scrubbing centers

network:
  preventive:
    - Stateful firewalls with deny-by-default
    - Network segmentation (VLANs, VPCs)
    - mTLS for service-to-service communication
  detective:
    - IDS/IPS (Suricata, Snort)
    - Network traffic analysis (Zeek)
    - DNS sinkholing
  corrective:
    - Automated quarantine of compromised segments
    - Dynamic ACL updates

endpoint:
  preventive:
    - EDR (CrowdStrike, Defender for Endpoint)
    - Application allowlisting
    - Full disk encryption (BitLocker, FileVault)
  detective:
    - Endpoint telemetry to SIEM
    - File integrity monitoring (AIDE, OSSEC)
  corrective:
    - Automated isolation of infected hosts
    - Remote wipe capability

application:
  preventive:
    - WAF rules (OWASP CRS)
    - Input validation and output encoding
    - SAST/DAST in CI/CD pipeline
  detective:
    - Application-level audit logging
    - Runtime application monitoring (RASP)
  corrective:
    - Automated rollback on security failure
    - Circuit breakers for compromised dependencies

data:
  preventive:
    - Encryption at rest (AES-256) and in transit (TLS 1.3)
    - Data classification and labeling
    - Column-level encryption for PII
  detective:
    - DLP monitoring (Microsoft Purview, Symantec)
    - Database activity monitoring
  corrective:
    - Automated data quarantine
    - Key rotation on compromise
```

### CIS Controls Mapping

```bash
# Map defense layers to CIS Controls v8
# Layer 1 (Perimeter): CIS 13 — Network Monitoring and Defense
# Layer 2 (Network):   CIS 12 — Network Infrastructure Management
# Layer 3 (Endpoint):  CIS 10 — Malware Defenses
# Layer 4 (App):       CIS 16 — Application Software Security
# Layer 5 (Data):      CIS 3  — Data Protection
# Layer 6 (Identity):  CIS 5  — Account Management, CIS 6 — Access Control
# Layer 7 (Ops):       CIS 17 — Incident Response
```

## Workflow

### Step 1: Inventory Current Controls

```bash
node scripts/agent.js --action inventory --scope all
```

### Step 2: Gap Analysis

```bash
node scripts/agent.js --action gaps --framework cis-v8
```

### Step 3: Design Compensating Controls

```bash
node scripts/agent.js --action recommend --gaps gaps.json --output plan.json
```

### Step 4: Validate Coverage

```bash
node scripts/agent.js --action validate --controls inventory.json
```

## Verification

- [ ] Every layer has at least one preventive and one detective control
- [ ] No single-point-of-failure in any security layer
- [ ] Controls mapped to CIS Controls v8 or NIST CSF
- [ ] Compensating controls documented for accepted risks
- [ ] Layer boundaries enforce deny-by-default
- [ ] Detective controls feed centralized SIEM
- [ ] Corrective controls tested via tabletop exercises
- [ ] Gap analysis reviewed quarterly

## References

- [CIS Controls v8](https://www.cisecurity.org/controls)
- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [NIST SP 800-53 Rev 5](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
