How do I install the Implementing Defense In Depth skill?

Run npx skillmds@latest add tomevault-io/implementing-defense-in-depth in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Implementing Defense In Depth safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Implementing Defense In Depth?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Implementing Defense In Depth free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Implementing Defense In Depth?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Implementing Defense In Depth by tomevault-io

Name: Implementing Defense In Depth
Author: tomevault-io

Implementing Defense In Depth

AI agent designs layered security architecture with multiple independent protective barriers ensuring no single point of failure. Use when building security systems, reviewing architecture, or hardening applications. Use when this capability is needed.

tomevault-io Updated Sep 17, 2026

File contents

Implementing Defense in Depth

Quick Start

Perimeter - WAF, DDoS protection, rate limiting, IP filtering
Network - VPC, security groups, mTLS, network policies
Application - Input validation, output encoding, CSRF, CSP
Data - Encryption at rest/transit, access control, classification
Identity - MFA, least privilege, session management
Monitoring - Logging, alerting, anomaly detection across all layers

Features

Feature	Description	Guide
Layered Protection	5+ independent security barriers	Each layer catches what others miss
Perimeter Security	First line of defense	WAF rules, rate limits, DDoS protection
Network Isolation	Segment and protect internal comms	VPC subnets, security groups, mTLS
Application Security	Secure code and request handling	Validate input, encode output, CSP headers
Data Protection	Protect data at rest and in transit	AES-256-GCM, field-level encryption
Identity Security	Authentication and authorization	MFA, RBAC, secure sessions

Common Patterns

# Security Layers Architecture
+--------------------------------------------------+
| LAYER 1: PERIMETER                               |
| WAF | DDoS | Rate Limiting | IP Filtering        |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 2: NETWORK                                 |
| VPC | Security Groups | TLS Everywhere           |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 3: APPLICATION                             |
| Input Validation | Output Encoding | CSRF | CSP  |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 4: DATA                                    |
| Encryption at Rest | Encryption in Transit       |
+--------------------------------------------------+
    |
    v
+--------------------------------------------------+
| LAYER 5: IDENTITY                                |
| MFA | Least Privilege | Session Management       |
+--------------------------------------------------+

CROSS-CUTTING: Logging | Alerting | Anomaly Detection

# Network Security Groups (Example)
loadBalancer:
  inbound:  [443 from 0.0.0.0/0]
  outbound: [8080 to application-sg]

application:
  inbound:  [8080 from load-balancer-sg]
  outbound: [5432 to database-sg, 443 to external]

database:
  inbound:  [5432 from application-sg]
  outbound: [] # No outbound

Best Practices

Do	Avoid
Implement all layers - each provides unique protection	Relying on a single security layer
Fail securely - deny access when in doubt	Trusting user input at any layer
Log security events for detection/forensics	Exposing detailed error messages
Rotate credentials regularly	Storing secrets in code
Validate all inputs at every layer	Skipping security in development
Encrypt sensitive data at rest and in transit	Assuming internal traffic is safe
Use least privilege for all access	Disabling security for "convenience"
Test security controls regularly	Ignoring security alerts

Related Skills

applying-owasp-security - OWASP security guidelines
implementing-oauth - OAuth authentication flows
implementing-better-auth - Modern auth patterns
verifying-before-completion - Security verification checklists

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: implementing-defense-in-depthdescription: AI agent designs layered security architecture with multiple independent protective barriers ensuring no single point of failure. Use when building security systems, reviewing architecture, or hardening applications. Use when this capability is needed.---# Implementing Defense in Depth## Quick Start1. **Perimeter** - WAF, DDoS protection, rate limiting, IP filtering2. **Network** - VPC, security groups, mTLS, network policies3. **Application** - Input validation, output encoding, CSRF, CSP4. **Data** - Encryption at rest/transit, access control, classification5. **Identity** - MFA, least privilege, session management6. **Monitoring** - Logging, alerting, anomaly detection across all layers## Features| Feature | Description | Guide ||---------|-------------|-------|| Layered Protection | 5+ independent security barriers | Each layer catches what others miss || Perimeter Security | First line of defense | WAF rules, rate limits, DDoS protection || Network Isolation | Segment and protect internal comms | VPC subnets, security groups, mTLS || Application Security | Secure code and request handling | Validate input, encode output, CSP headers || Data Protection | Protect data at rest and in transit | AES-256-GCM, field-level encryption || Identity Security | Authentication and authorization | MFA, RBAC, secure sessions |## Common Patterns```# Security Layers Architecture+--------------------------------------------------+| LAYER 1: PERIMETER || WAF | DDoS | Rate Limiting | IP Filtering |+--------------------------------------------------+ | v+--------------------------------------------------+| LAYER 2: NETWORK || VPC | Security Groups | TLS Everywhere |+--------------------------------------------------+ | v+--------------------------------------------------+| LAYER 3: APPLICATION || Input Validation | Output Encoding | CSRF | CSP |+--------------------------------------------------+ | v+--------------------------------------------------+| LAYER 4: DATA || Encryption at Rest | Encryption in Transit |+--------------------------------------------------+ | v+--------------------------------------------------+| LAYER 5: IDENTITY || MFA | Least Privilege | Session Management |+--------------------------------------------------+CROSS-CUTTING: Logging | Alerting | Anomaly Detection``````# Network Security Groups (Example)loadBalancer: inbound: [443 from 0.0.0.0/0] outbound: [8080 to application-sg]application: inbound: [8080 from load-balancer-sg] outbound: [5432 to database-sg, 443 to external]database: inbound: [5432 from application-sg] outbound: [] # No outbound```## Best Practices| Do | Avoid ||----|-------|| Implement all layers - each provides unique protection | Relying on a single security layer || Fail securely - deny access when in doubt | Trusting user input at any layer || Log security events for detection/forensics | Exposing detailed error messages || Rotate credentials regularly | Storing secrets in code || Validate all inputs at every layer | Skipping security in development || Encrypt sensitive data at rest and in transit | Assuming internal traffic is safe || Use least privilege for all access | Disabling security for "convenience" || Test security controls regularly | Ignoring security alerts |## Related Skills- `applying-owasp-security` - OWASP security guidelines- `implementing-oauth` - OAuth authentication flows- `implementing-better-auth` - Modern auth patterns- `verifying-before-completion` - Security verification checklists---> Converted and distributed by [TomeVault](https://tomevault.io/claim/doanchienthangdev) — claim your Tome and manage your conversions.

Frequently asked questions