Defense in depth

Stack independent security layers, such as WAF, network isolation, authentication, encryption and least privilege, so that one failure does not expose everything.

Where it shows up in real systems

  • Web application firewall

    Managed rules stop SQL injection, XSS and known bots. Stricter rule sets block more attacks but also some legitimate users, which is why teams tune them in count mode first.

    In production: AWS WAF, Cloudflare WAF, Azure WAF, ModSecurity

  • Private network

    Only load balancers belong in public subnets; databases and app servers stay private. Security groups then allow only the traffic each tier needs.

    In production: AWS VPC, Azure Virtual Network, Google VPC

  • DDoS protection

    Floods of millions of packets per second are dropped by a provider's global network. The advanced tiers cost a fixed monthly fee but include attack response teams and cost protection for the scaling an attack triggers.

    In production: AWS Shield Advanced, Cloudflare DDoS protection, Azure DDoS Protection, Google Cloud Armor

See it break, then fix it

Build an architecture, send it a day of traffic and outages, and learn why it holds or fails. Free to start.

Open the learning path Open the sandbox