Defense-in-Depth

AP Cybersecurity · Securing Spaces

Why Defense in Depth Is Necessary

Every control has a bypass. The next layer is what catches it.

key ideaLayer because every control has a bypass — and the next layer is what catches it.

Matching controls to threats

Defense in depth is not ‘more security’. It is the deliberate use of multiple types of control, so that different threats each meet the control best suited to them and no single bypass reaches the data.

Threat	Layer that answers it	Why that layer
a convincing phishing call	human — training, callback procedure	no device can stop a person choosing to comply
someone walking in behind staff	physical — vestibule, guard	the attack happens in a corridor, not on a wire
a worm spreading between machines	network — segmentation	limits how far it can travel
a malicious USB drive	device — disabled ports, anti-malware	the attack lands on one host
injected input in a web form	application — input sanitization	only the application can see the input's meaning
a stolen backup tape	data — encryption	the data defend themselves once out of the building

Each row is a different threat needing a different kind of control. That is EK 2.1.G.2 — layers exist because threats differ, not because one control is insufficient.

the four claims of EK 2.1.G

Layering uses multiple types of control — physical, technical, managerial together.
Different threats are each met by the control most suited to mitigate them.
Resilience: when one control is bypassed, another may still prevent access or limit damage.
The CED names six layers: human, physical, network, device, application, data.

Layering

Different threatsdifferent best-fit controls

One bypassthe next layer still holds

Six layershuman → data

An adversary must defeat every layer to reach the data, and each one is a fresh chance to be stopped or noticed. Adding a second lock to the same door is not a layer — it repeats a control that has already been bypassed.

Scenario	Layer that failed	Layer that saved it
an employee clicked a phishing link	human	device — anti-malware blocked the payload
malware ran on one laptop	device	network — segmentation stopped it spreading
an attacker reached the file server	network	data — the files were encrypted at rest
a laptop was stolen from a car	physical	data — full-disk encryption
every layer above failed	all	corrective — tested offline backups

Read this as the argument for resilience. Each row is a real bypass that did not become a breach, because the layer beneath it was a different kind of control.

Defense in depthA layered defense using multiple types of security control — not multiple copies of one.

ResilienceThe property that when one control is bypassed, another may still prevent access or limit the damage.

LayerOne of human, physical, network, device, application, data — the six named by the CED.

Independent failureTwo controls that fail for different reasons. Two of the same product fail together.

Worked analysis

EX 1

Diagnose a flat defense

A firm has three firewalls in series from the same vendor, and nothing else. Is this defense in depth?

Count the types

One type: technical, network layer.

Ask what a bypass costs

A flaw in that vendor's software defeats all three at once.

Apply the definition

Defense in depth requires multiple types of control, not multiple copies.

Name the missing layers

Nothing at human, physical, device, application or data.

Give the answer

No — this is depth of quantity, not of kind.

EX 2

Trace a bypass through the layers

An adversary phishes credentials, logs in from outside, and reaches a database server. Where could each layer have intervened?

Human

Training and a callback habit could have stopped the disclosure.

Network

Segmentation and MFA on remote access could have blocked the login.

Device

Endpoint monitoring could have flagged the unusual session.

Application and data

Least-privilege access and encryption at rest limit what the credentials reach.

State the conclusion

Four independent opportunities to stop one attack. That is the whole argument for layering.

EX 3

Choosing the next layer to fund

A school has locks, cameras, a firewall and anti-malware, but no backups and no staff training. What should it buy next?

Classify what exists

Physical and technical; functions are prevention and some detection.

Identify the missing layer

Human is entirely absent — and phishing is the most common route in.

Identify the missing function

Nothing corrective: a ransomware incident would be unrecoverable.

Weigh cost against expected loss

Training and backups are both cheap relative to the loss they prevent.

Recommend

Backups first, then training. Buy the missing kinds of control before more of what you already have.

Check yourself

What is a defense-in-depth strategy?

Show answer

A layered defense using multiple types of security control to protect sensitive data and systems — physical, technical and managerial together, not more of one kind.

Give the two reasons the CED offers for layering.

Show answer

Different threats are each met by the control most suited to mitigate them; and it provides resilience — when one control is bypassed, another may still prevent access or limit the damage.

Name the six layers.

Show answer

Human, physical, network, device, application, data.

Why are two firewalls from the same vendor not a layered defense?

Show answer

They are the same type of control at the same layer, so a single flaw defeats both. Layering means controls that fail for independent reasons.

Course map. Topic 2.1.g · LO 2.1.G — explain why a defense-in-depth security strategy is necessary to optimally protect an organization (EK 2.1.G.1–2.1.G.4: layered defense using multiple types of control; addressing different threats with best-suited controls; resilience when one control is bypassed; the human, physical, network, device, application and data layers).