Explain like I'm five · Security

What is Defense in Depth?

Defense in depth, told as a story about a castle with a moat, walls, hall watchmen, guard dogs, and locks — all layered.

the vaultone ladder is all it takesone wall: climb it, and it's over

With one wall, climbing it is the whole game.One ladder is all it takes. Past the wall, it's straight to the vault — nobody stops it, nobody knows.

by tunnelthe fake letter walks in the doorthe bell stays silentthe wall, made tallera taller wall is still one wall — and when it gives, nobody knows

A taller wall is still just one wall.A thief gets the door opened with a fake letter, or digs under. And when that one wall gives, there's no one left to ring the bell.

moat · wallhallsdogslockspeoplelayer on layeroutside: the moat and the gate checkpointhalls: colored ribbons and doorkeepersevery room: a guard dogchests: key rings and sealspeople: thief lessonsno single layer is perfectone layer gives, the next holds — and the bell rings

Defense in depth is walls within walls.Outside, the gate checkpoint; in the halls, colored ribbons and doorkeepers; a guard dog in every room; key rings and seals on the chests; and people who took the thief lessons. One gives, the next holds.

Layer on layerfive layers from outside to vault
One givesthe next one holds
A bell on every layerhard to pass all of them unseen
No perfect layerthat's why they overlap
climbed over ×1 amspotted! bell1:05 amWOOF!barks1:06 amwon't open1:08 amsafeguards arrivethe thief who cleared the moat is spotted in the hall and stopped at the doorevery layer buys time, and every layer can ring the bell

Every layer buys time, and every layer can ring the bell.The thief who cleared the moat is spotted by the hall watchman, the dog barks, and the door is locked. Meanwhile the guard room is on its way.

moathallsdogslocksthe vaultthe holes never line upevery layer has a hole — that's why they overlap

Every layer has a hole. That's why they overlap.No layer is perfect — the holes just must never line up. Modern castles add asking at every door on top. Which promise each layer keeps is in the three promises.

In one breath

Defense in depth = never lean on one wall; layer the moat, halls, dogs, locks, and people so that when one gives, the next holds — and the bell rings in between.

A principle of stacking independent controls across layers — perimeter (firewall, WAF), network (VLAN, NAC), endpoint (EDR, antivirus), data (encryption, access control), people (awareness) — so that a single failed control doesn't let an attack through, and every layer adds a chance to detect it.

When grown-ups say it

Defense in depth
Walls within walls. One gives, the next holds. Each layer must guard a different way — two of the same wall are still one layer.
Single point of failure
The one wall. The one place that ends everything if it gives. Defense in depth exists to remove it.
Perimeter layer
The moat and the gate checkpoint. The first filter for anything from the village. → the wall with many doors, the note checker at the counter
Network layer
Ribbons and doorkeepers in the halls. Even inside, not every hall is open. → halls divided by ribbon, a doorkeeper at every socket
Endpoint layer
A dog in every room. Catches trouble inside the room. → a guard dog in every room, the guard with bug cards
Data layer
Locks and seals on the chests. Reach the room, and the chest still won't open. → the letter no one reads without the key, a key ring for every hat
Human layer
People who took the thief lessons. The last layer is an eye that spots the fake letter. → thief lessons for everyone
Zero trust
Trusting no one, even inside a layer. After the layers, ask again at every door. → the castle that asks at every door
Next story
The Yard Between the Walls →
Want another term as a picture book? Request →