Defense in depth
Security principle: multiple independent layers of defence — if one fails, the next holds.
Layers: firewall → WAF → authentication → authorisation → input validation → encryption → audit. Assumption: any layer can be breached; just unlikely all at once. Originates from military doctrine.