Defense in depth is a security strategy that stacks independent layers of controls so that a failure in any single layer does not expose the whole system. If a firewall is bypassed, intrusion detection, host hardening, encryption, and access controls each still stand between the attacker and the asset.
The idea borrows from military fortification, where one wall is never the only obstacle. In practice, the layers should be diverse rather than duplicate copies of the same control. Pairing a firewall with monitoring, segmentation, and strong authentication protects more than five identical packet filters, because an attacker who defeats one technique usually defeats every identical instance of it. Watch out for teams that buy overlapping tools yet leave the gaps between them unwatched.
Why does defense in depth matter for the CISSP exam?
Defense in depth runs through Domain 3, Security Architecture and Engineering, where it shapes how you design layered protection, and it returns in network and operations questions. The exam favors answers that add complementary controls over any single silver bullet. See Domain 3: Security Architecture and Engineering for how layered design supports resilient systems.
CISA outlines layered practices in its Cybersecurity Best Practices.