Principle: Defense in depth for security

Relying on a single security mechanism means one breach compromises everything. If the firewall is bypassed, or the auth token is stolen, there is no fallback.

Layer multiple independent security controls:

1. Network layer:

- Firewall rules, VPC isolation
- TLS everywhere (even internal services)
- IP allowlisting where appropriate

1. Authentication layer:

- Strong passwords + MFA
- Token expiration and rotation
- Session management

1. Authorization layer:

- Role-based access control (RBAC)
- Resource-level permissions
- Principle of least privilege

1. Application layer:

- Input validation and sanitization
- Parameterized queries (prevent injection)
- Output encoding (prevent XSS)
- CSRF tokens

1. Data layer:

- Encryption at rest
- Encryption in transit
- Column-level encryption for sensitive data
- Audit logging

1. Monitoring layer:

- Anomaly detection
- Failed auth attempt alerts
- Rate limiting

Each layer should work independently — if one fails, others still protect.

No single security measure is perfect. Layered defenses ensure that compromising one layer does not grant full access.