Defense in Depth

An attacker tries to reach patient data through layers — WAF, gateway auth, service authorization, network isolation, DB permissions, encryption. Toggle layers on and off and watch how far the attack gets when one fails.

An attacker is heading for the patient data. Toggle security layers off (simulating failures or gaps) and launch the attack — watch how far it gets before something stops it.

😈attacker

→

🛡️WAF

→

🚪Gateway auth

→

🔐Service authz

→

🌐Network isolation

→

🗄️DB permissions

→

🔒Encryption

→

📁Patient data

Turn off WAF and gateway auth and attack — service authz still stops it. Keep turning layers off one by one; only when the last one falls does the attacker reach the data.

What just happened

▹Defense in depth means stacking independent security layers — WAF, gateway auth, service authorization, network isolation, DB permissions, encryption. No single layer is trusted to be perfect.
▹The point is survivability: turn any ONE layer off and the next one still catches the attack. A breach needs MANY layers to fail at once, which is far less likely than one mistake.
▹Pair it with fail-safe defaults — deny by default, block public access by default. Layers + safe defaults are why a single misconfiguration usually doesn't become a headline.