The Philosophy of Defense in Depth

In this lesson, you will learn how to unify disparate Linux security mechanisms into a cohesive "Defense in Depth" strategy where no single failure compromises your entire system.

The Onion Model of Security

Defense in Depth is built on the principle that security layers should overlap like an onion. If one layer—such as a file permission—is misconfigured or bypassed, subsequent layers like Mandatory Access Control (MAC) or network constraints should catch the threat.

In Linux, we do not rely solely on chmod or chown. Instead, we combine them with structural defenses. Think of it as a house: you don't just lock the front door; you install a deadbolt, a motion sensor, and a neighborhood patrol.

Integrating the Layers

To build a holistic model, we look at how security controls interact across the stack:

1. The Base Layer (POSIX/Discretionary): Use standard file permissions to restrict access to sensitive system binaries.
2. The Context Layer (MAC/Capabilities): Even if a process is running as root, we use capabilities or MAC profiles (like AppArmor or SELinux) to limit what that process can actually do (e.g., preventing it from opening network sockets).
3. The Observability Layer (Audit/eBPF): We implement auditing to monitor for security drift. If a policy is violated, the audit pipe catches the attempt, providing a secondary defense by alerting administrators before an escalation becomes permanent.
4. The Network/Isolation Layer: We apply controls to the network interface, ensuring that even if a service is compromised, it cannot reach out to unauthorized infrastructure.

Practical Application: Imagine protecting a web server. You shouldn't just set permissions; you lock it down by:

• Setting restricted POSIX bits on data files.
• Applying a systemd unit file with ProtectSystem=strict and CapabilityBoundingSet= to shrink the process's attack surface.
• Using an eBPF program to monitor for unauthorized syscalls.

# Example: Reducing a service's privileges in systemd
[Service]
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
ProtectSystem=strict
PrivateTmp=true

By layering these controls, you ensure that the failure of any single component—such as an accidentally permissive chmod—does not lead to a total system compromise.

Key Takeaway: Defense in Depth means layering your controls so that the failure of any one mechanism is mitigated by the strength of the others.