Defense in Depth
Architecture & DesignDefense in Depth is the practice of implementing multiple layers of security controls so that no single point of failure can compromise the entire system. If an attacker bypasses one layer, they face another.
AWS Layers
- Edge: CloudFront, WAF, Shield (DDoS, L7 filtering)
- Network: VPC, subnets, security groups, NACLs, Network Firewall
- Identity: IAM, SCPs, permission boundaries, MFA
- Application: input validation, authentication, authorization
- Data: encryption at rest/transit, key management, access logging
- Monitoring: CloudTrail, GuardDuty, Security Hub, Config
Related Terms
A security model where no user, device, or network is trusted by default - every access request is verified regardless of location, using identity-based policies and continuous validation.
Dividing a network into isolated segments (subnets, VPCs) to limit lateral movement and contain the blast radius of a security breach.
The framework defining that AWS is responsible for security of the cloud (infrastructure), while customers are responsible for security in the cloud (data, access, configuration).
The scope of impact when a security incident occurs - how many resources, accounts, or users are affected. Smaller blast radius means better security posture.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.