The most important asset in the defense in depth paradigm is human intelligence: employing security savvy people responsible for continuous and persistent defense.
Tools change, web app frameworks change, new exploit techniques are discovered – things preluding building a strong human team to help defend.
Moving onto tactics, but still at high level:
secure coding (app layer) -> empowering teams to develop attacker-resilient applications -> OWASP
secure infrastructure -> empowering teams to deploy attacker-resilient servers and supporting equipment
The Center for Internet Security (CIS) is a non-profit enterprise whose Benchmarking and Metrics Division helps organizations reduce the risk of business and e-commerce disruptions resulting from inadequate technical security controls. The Division provides enterprises with consensus best practice standards for security configurations, as well as resources for measuring information security status and for making rational decisions about security investments.
Defense Information Systems Agency (DISA)
The National Checklist Program (NCP), defined by the NIST SP 800-70 Rev. 1, is the U.S. government repository of publicly available security checklists (or benchmarks) that provide detailed low level guidance on setting the security configuration of operating systems and applications.
capable incident detection and response -> empowering teams to detect, contain, respond, & fix
collection of incident response checklists: http://www.knowyourenemy.eu/checklists.php
Richard Bejtlich recently blogged:
"Resources for Building Incident Response Teams
Recently a colleague asked me for resources for building incident response teams. I promised I would provide a few ideas [...]
The CERT.org CSIRT Development site is probably the best place to start. From there you can find free documents, links to classes offered by SEI on building CIRTs, and so on. I don't think you can beat that site!
I don't think the resources at the FIRST site are as helpful, but the process of working toward membership is a great exercise for a new CIRT.
My TaoSecurity books page lists several books which CIRTs will likely find helpful."
In the name of brevity, maybe the above suffices?