A courts case-management review finds the team relies on a WAF alone while application tiers sit in public subnets with broad security groups and unencrypted data stores. Which conclusion is correct?

A courts case-management review that leans on a WAF alone while application tiers sit in public subnets with broad security groups and unencrypted data stores misunderstands defense in depth. Defense in depth requires complementary controls across layers—for example WAF, restrictive security groups, private subnets, and KMS encryption—not dependence on one perimeter control. That conclusion is correct because professional architectures for sensitive case data assume any single control can fail or be misconfigured. Claiming a strong WAF makes private subnets, security groups, and KMS optional fails conceptually: perimeter filtering does not encrypt data at rest or constrain east-west paths. Moving databases to public subnets to “improve” defense in depth by shortening health-check paths fails by expanding exposure. Disabling security groups after enabling Shield Advanced fails because Shield addresses volumetric/network DDoS classes, not application identity, subnet placement, or encryption requirements. Exam caveat: more layers are not automatically better if they are redundant paper controls; each layer should address a distinct failure mode with owners and tests. Operational check: inventory case-management tiers for subnet placement, SG breadth, WAF association, and KMS encryption; remediate gaps to private data tiers with encryption; and present the layered control map in the security review.