What does defense in depth mean in a network?
Show the answer
Say this first
Layered controls, so that no single failure exposes the business. Each layer assumes the one before it can fail. In a network that means filtering and an NGFW at the edge, segmentation inside (VLANs, VRFs, internal firewalls), access control at the port with 802.1X, first hop protections like DHCP snooping and DAI, hardened network devices, endpoint protection, encryption in transit, and monitoring good enough to notice an attacker who got past all of it.
Go deeper
Walk an attack through the layers
A user receives a phishing email.
- The mail filter catches most of these.
- The user clicks anyway. Endpoint protection blocks the payload, or not.
- The malware calls home. DNS security and URL filtering on the NGFW block the domain, or not.
- The attacker tries to move sideways. Segmentation means the user VLAN can reach only the applications it needs, not server management ports or other users.
- The attacker steals an admin password. MFA, TACACS+ with command authorization, and management reachable only from jump hosts stop it from becoming network control.
- Something unusual happens anyway. NetFlow, IDS and the SIEM notice the odd flows.
Every step is a chance to stop or detect the attack. Without layers, step 2 is game over.
Not only technology
Patching, change control, backups that are tested and kept offline, least-privilege accounts, and training are layers too.
They will ask next
How does defense in depth relate to zero trust?
Zero trust is a stricter version of the same idea: do not trust the inside either, and verify every request on its own merits, not because of where it comes from.
What is the most common weak layer you see?
A flat internal network. Once something is inside, everything is reachable, so one infected laptop can scan and attack every server.
Traps
- Answering with a list of products. The interviewer wants the principle and an example of layers working together.