Skip to content
sec/atlas
back to the map
concept
2 min read

Defense in depth: edge system design

Designing the defense means deciding, layer by layer, who inspects what, how much latency it costs and whether the system opens or closes when a control goes down.

CloudflareAPI GatewayEnvoyTerraform

What it is

A request crosses several layers before reaching the data: the edge (CDN and ), an API gateway, the application and the database. is designing the whole so that the failure or bypass of one layer does not bring down the rest, placing each control where it is cheapest and most precise.

The request path and the role of each layer

The edge is great for what does not depend on business context (volume, signatures, bots). But it does not know whether a user may see that order: that is authorization, and only the application knows it. Each layer covers the blind spot of the previous one.

layers, from edge to datatext
client
  -> edge (CDN + WAF + bot + rate limit)   cheap, at scale: block the obvious and the volumetric
  -> API gateway                             identity, schema, per-client quotas
  -> application                             per-object authorization, business rules
  -> data                                    least privilege, encryption, auditing

Locking down the origin

An excellent WAF is useless if the attacker talks directly to the origin. The origin should accept traffic only from the edge: provider IP list, mutual authentication between edge and origin, or private tunnels. Without this, anyone who discovers the real address bypasses all the protection.

Fail-open or fail-closed

Every security layer can fail (configuration error, outage, faulty rule). The design question is what happens: fail-closed blocks everything (safe, but it is an outage), fail-open lets traffic through (available, but unprotected). There is no universal answer: a payment endpoint tends to close, a public page tends to open, and the decision should be conscious, documented and tested.

Latency and blast radius

  • Latency budget: each layer adds milliseconds; deep body inspection fits only where it matters.
  • : a new rule hits all traffic; that is why the rule first enters observation and on a subset.
  • Change as code: rules in a repository (Terraform, for example), with review and rollback, instead of clicks in the dashboard.
  • Observability in all layers, to know in which one a request was stopped.
WAFweb application firewallAn edge filter that blocks known attack patterns in HTTP. It complements the code: it does not replace fixing the vulnerability, it only buys time.see in glossary →Defense in depthIndependent layers of protection, on the premise that any one of them can fail: validation + parameterization + WAF + monitoring.see in glossary →Blast radiusblast radiusThe size of the damage when something breaks: one account, an entire region, a tenant. Good cloud design limits the radius through isolation (separate accounts, separate VPCs, narrow roles) so that a failure or an attack does not become a full-blown disaster.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Study before

test what you learned

Loading questions…