Defense in depth
Every security control fails sometimes. Defense in depth stacks independent layers so that an attack stopped at any one of them doesn’t become a breach. Send real-world attacks against a layered model in 3D and see where each is caught.
In this lecture you will
- Explain why layered, independent controls beat any single strong control
- Name typical controls at the perimeter, network, endpoint, application and data layers
- Explain zero-trust principles and least privilege
- Plan detection and recovery, not only prevention
In 2017, a single unpatched web server at a credit bureau led to the theft of personal data on well over a hundred million people. The flaw was known; a patch existed. But the breach was not only a patching failure — the attackers also moved between systems for weeks without being detected. One failed control became a catastrophe because the others didn’t stop it. Defense in depth is the discipline of making sure that doesn’t happen.
Assume every control fails
Firewalls get misconfigured. Spam filters miss emails. People click links. Software has bugs nobody has found yet. So instead of seeking one perfect control, we arrange several independent layers, each able to stop or slow an attack that got past the ones before. An attacker then has to succeed several times in a row; defenders only need one layer to hold.
Send attacks through the layers
Step through five common attacks and watch where each is stopped. Drag to look at the model from other angles.
- Layers around the dataPerimeter, network, endpoint, application and data controls surround what you care about most. People and processes — training, reviews, incident response — span all of them.
- An exploit attemptAn automated scanner probes every port and tries known exploits. The perimeter firewall exposes only port 443, so there is nothing else to attack.
- A phishing attachmentA convincing email slips past the filter and an employee opens the attachment. Endpoint protection recognizes the malicious behaviour and blocks it.
- A stolen passwordAn employee’s password leaked from another site. The attacker tries it — and is stopped by multi-factor authentication at the application.
- A compromised serverAn attacker gains control of a web server. Network segmentation means that server can’t open a connection to the database, so the attack stalls.
- When several layers failIn a serious breach, encryption, access logging and tested offline backups decide whether an incident is a bad week or a company-ending event.
Controls at each layer
- Perimeter
- Firewalls exposing only necessary ports, web application firewalls, email filtering, DDoS protection.
- Network
- Segmentation between environments and tiers, private subnets for databases, zero-trust access instead of flat VPNs.
- Endpoint
- Automatic patching, device management, disk encryption, endpoint detection and response (EDR).
- Application
- Strong authentication with MFA, authorization checks on every request, input validation, secure defaults.
- Data
- Encryption at rest and in transit, least-privilege access, audit logging, immutable and offline backups.
A firewall is the simplest layer to picture. Send packets through a small rule set and watch how the decision is made:
Rules are checked top to bottom and the first match wins; whatever matches nothing is dropped by the default deny. Put specific rules above general ones, and review rule sets regularly — old “temporary” rules are a classic way in.
Zero trust and least privilege
Traditional networks were like a castle: a strong wall, and anyone inside was trusted. Remote work, cloud services and phones broke that model — and attackers learned to get one foot inside and roam freely.
Zero trust replaces location with verification: every request is authenticated and authorized based on who is asking, from which device, for what, in what context. It pairs naturally with least privilege — every user, service and machine gets only the permissions its job requires. When something is compromised, the damage it can do — its blast radius — stays small.
Compare the blast radius of the same compromised identity with broad and with least-privilege permissions:
Broad permissions are convenient until something is compromised: then every resource the identity can reach is exposed. Grant each person, service and machine only what its job needs, and review permissions when jobs change.
Prevent, detect, respond, recover
Prevention is only one of four jobs. Mature teams invest in all of them:
- Detect — centralized logs, alerts on suspicious behaviour, someone who looks at them.
- Respond — a rehearsed plan: who decides, how systems are isolated, how customers and regulators are informed.
- Recover — backups that are offline or immutable and have actually been restored in a test.
Many of these layers rely on cryptography. Next, we look at the three tools — hashing, symmetric and asymmetric encryption — that protect data everywhere.
Key takeaways
- Assume any single control can fail; layers make attackers defeat several independent defences.
- Controls exist at every layer — perimeter, network, endpoint, application and data — and people and process span them all.
- Zero trust means verifying every request based on identity and context, not trusting anything because it is “inside”.
- Detection, response and tested backups limit the damage when prevention fails.
Check your understanding
3 questions · answers explainedQ1A phishing email gets past the spam filter and a user opens the attachment. Which layer can still stop the attack?
Q2What does the principle of least privilege mean?
Q3Why is “inside the corporate network” no longer treated as trusted in a zero-trust model?