Why stack defenses rather than rely on a single wall?
If you've been administering an Exchange environment or Active Directory domain for a few years, you've probably heard the term defense in depth without necessarily knowing where it comes from or how it works in practice. The idea is simple: instead of putting all your trust in a single firewall or antivirus, you stack multiple layers of independent controls. If one fails, the next one takes over.
Medieval castle analogy
Think of a medieval castle: moat, outer wall, inner courtyard, keep. Each obstacle slows down the attacker and gives defenders time to react. The limitation of the analogy: in a computer network, the attacker can sometimes appear directly in the "inner courtyard" via a phishing email, without ever crossing the outer wall. This is precisely why internal monitoring and segmentation matter as much as the perimeter.
This architecture is not abstract theory: it describes what most mature enterprises actually deploy, from the end user to managed detection tools.
The five pillars that guide all security architecture
Before detailing the technical layers, we must understand the objectives they serve. Five principles structure virtually all enterprise security architectures:
- Confidentiality: prevent data from being read by someone not authorized to access it.
- Integrity: ensure that data has not been modified without authorization.
- Availability: ensure that services remain accessible when needed.
- Monitoring: detect abnormal activity as early as possible.
- Resilience: continue to function, even in degraded mode, during or after an attack.
Each technical component described below actually addresses one or more of these five objectives. An application firewall serves confidentiality and integrity, a tested backup serves resilience, a SIEM serves monitoring.
First contact: from the user endpoint to the network perimeter
The journey of a traffic flow begins with the users themselves: office workers, remote workers, external partners. Their connections use TLS 1.3, the current version of the encryption protocol that secures web exchanges (the direct successor to what used to be called SSL). For remote access, IPsec, SSL, or VPN (virtual private network) tunnels are used, which create an encrypted channel over the Internet, somewhat like an opaque pipe stretched between two public points.
At the entry of the network is the perimeter zone, with several complementary devices:
- The WAF (Web Application Firewall) specifically filters traffic destined for web applications, blocking SQL injection attempts for example.
- The NGFW (Next-Generation Firewall) goes further than a classic firewall by inspecting the application content of traffic, not just ports and IP addresses.
- The SPF, DKIM, and DMARC protocols authenticate the origin of emails and protect against domain spoofing, one of the most common phishing vectors.
Mnemonic guide
SPF verifies "who has the right to send", DKIM verifies "the message was not modified", DMARC says "what to do if one of the two fails". Three questions, three protocols.
The DMZ and internal segmentation: compartmentalize to limit damage
Just behind the perimeter is the DMZ (demilitarized zone), a term borrowed directly from military vocabulary to designate a buffer zone. It hosts servers exposed to the Internet — web, mail, DNS — without ever giving them direct access to the internal network. An IDS/IPS device (intrusion detection and prevention system) continuously monitors this critical junction zone to identify suspicious behavior.
On the internal network side, the core relies on layer 3 switches and routers, but the real value comes from segmentation: the network is divided into distinct zones rather than allowing everything to communicate freely. We typically distinguish:
- the user network (workstations, printers), protected by 802.1X / NAC access control which verifies the identity of a device before even giving it an IP address,
- business servers hosting applications and databases,
- the administration network, reserved for privileged access and secured via SSH.
This separation limits what is called lateral movement: even if an attacker compromises a user workstation, they should not be able to jump directly to a database server without crossing other controls.
| Layer | Primary role | Example tools |
|---|---|---|
| Perimeter | Filter incoming traffic | WAF, NGFW, SPF/DKIM/DMARC |
| DMZ | Isolate public services | IDS/IPS |
| Internal network | Segment and compartmentalize | VLAN, 802.1X/NAC, SSH |
| Identity | Authenticate and limit privileges | IAM, Active Directory, MFA |
| Monitoring | Detect and respond | SIEM, SOAR, EDR/XDR |
Cross-cutting components: identity, backup, and encryption
Under the network architecture are cross-cutting services that structure end-to-end governance:
- IAM (Identity and Access Management) and Active Directory centralize authentication, with Kerberos for identity verification, MFA (multi-factor authentication) to add a second proof, and the principle of least privilege to limit each account to the bare minimum.
- The administration bastion is a mandatory gateway for privileged access: it tracks every session and prevents an administrator from connecting directly, without supervision, to a critical server.
- Backup and BCP (business continuity plan) are worthless if never tested: regular restoration exercises are the only way to know if a backup is truly usable in case of disaster.
- Data encryption at rest (often in AES-256, a symmetric algorithm recognized as robust) and in transit (TLS 1.3 / IPsec) protects confidentiality, whether the data is stored on a disk or traveling across the network.
Common pitfall
Many organizations encrypt their backups but forget to test restoration. An untested backup is a hypothesis, not a guarantee of resilience.
See and respond: SIEM, SOAR, EDR/XDR
All previous layers block or slow down an attack. But you still need to know it's happening. This is the role of the monitoring and response block:
- The SIEM (Security Information and Event Management) collects logs from the entire infrastructure and correlates them to detect attack patterns that a single isolated log would never reveal.
- The SOAR (Security Orchestration, Automation and Response) automates responses: isolate a workstation, revoke a session, open a ticket, without waiting for a human to manually click each action.
- EDR/XDR (Endpoint/Extended Detection and Response) continuously monitors workstations and servers, detects malicious behavior, and can respond directly on the device, for example by isolating a machine from the network.
Together, these three components transform a stack of static controls into a system capable of detecting an incident and responding to it in minutes rather than days.
Transposing this model in a Microsoft 365 and Azure environment
If your enterprise relies on the Microsoft ecosystem, this architecture is not theoretical: it corresponds almost brick by brick to services you may already be using.
- Entra ID (formerly Azure AD) covers the IAM layer: centralized authentication, MFA, conditional access, and privileged identity management.
- Microsoft Sentinel plays the role of SIEM and SOAR: collects logs from multiple sources, correlates them via detection rules, and provides automation playbooks for response.
- Microsoft Defender (Defender for Endpoint, Defender for Office 365, Defender for Cloud Apps) ensures the EDR/XDR function on workstations, mailboxes, and SaaS applications.
This correspondence is useful for mapping your existing environment: if you already have Entra ID, Sentinel, and Defender, you already have most of the cross-cutting layers of this architecture. What's often missing, however, is operational discipline — network segmentation, restoration tests, regular privilege reviews — which makes all the difference between architecture on paper and truly effective defense.
Key takeaways
- Defense in depth relies on stacking independent controls, not a single magic tool.
- Five objectives guide technical choices: confidentiality, integrity, availability, monitoring, resilience.
- Network segmentation (DMZ, VLAN, 802.1X/NAC) limits lateral propagation of a compromise.
- Identity (IAM, MFA, least privilege) and monitoring (SIEM, SOAR, EDR/XDR) are as critical as network perimeter.
- In a Microsoft environment, Entra ID, Microsoft Sentinel, and Microsoft Defender cover the essence of these cross-cutting layers — provided they are configured and tested regularly.
