Security Basics
Defense in Depth
This lesson covers
The core idea behind layered security → The seven layers and what each one does → Compensating controls when a layer fails → Detection vs prevention layers → Putting it together in a real architecture → Reading a layered defence in a config file
No single security control is unbreakable. Passwords get stolen. Firewalls get misconfigured. Antivirus misses new malware. Patches arrive late. Defense in depth is the acknowledgement that any one control will eventually fail — and the deliberate decision to make sure that failure doesn't end the game. It's not about building one perfect wall. It's about making sure there's always another wall behind the one that just came down.
The core idea — layers, not locks
A single strong control feels safe. It isn't. Every control has a failure mode — a way it can be bypassed, broken, misconfigured, or simply not triggered for the specific attack coming at it. Defense in depth accepts this as a given and responds by stacking controls so that bypassing one still leaves an attacker facing several more.
The goal isn't to make intrusion impossible — that's not achievable. The goal is to make it slow, noisy, and expensive enough that the attacker either gives up or gets caught before reaching what they came for. Every additional layer an attacker has to work through is another opportunity for detection, another decision point where they might fail, another log entry that triggers an alert.
This is also why detection layers matter as much as prevention layers. A prevention control tries to stop the attack entirely. A detection control assumes the attack is happening and raises the alarm. An organisation that only has prevention controls is blind the moment one of them fails. An organisation with both can respond even when prevention doesn't hold.
The seven layers of defense
Defense in depth is often mapped across seven layers, each targeting a different attack surface. An attacker trying to reach sensitive data has to work through all of them — and failing at any one stops the chain.
① Physical
Locked server rooms, badge access, security cameras, cable locks. An attacker with physical access to a machine can bypass almost everything else — so physical security is the outermost layer.
② Network Perimeter
Firewalls, DMZs, border routers, DDoS protection. Filters what traffic is allowed into the network at all. The first technical layer an external attacker hits.
③ Internal Network
Segmentation, VLANs, internal firewalls, IDS/IPS. Limits lateral movement — an attacker who gets past the perimeter can't freely reach every system inside.
④ Host
OS hardening, endpoint protection, patch management, host-based firewalls. Secures individual machines — even if the network layer is breached, each host defends itself.
⑤ Application
Input validation, secure coding, WAFs, authentication. Attacks targeting the application layer — SQL injection, XSS, broken access control — are stopped here.
⑥ Data
Encryption at rest and in transit, data masking, DLP controls. Even if an attacker reaches the data, encryption makes it useless without the keys.
⑦ Human
Security awareness training, phishing simulations, clear reporting channels. The most exploited layer — social engineering bypasses every technical control if the person behind the keyboard is the vulnerability. Training doesn't eliminate this but it significantly raises the cost of the attack.
Lateral movement — the attack that layers are built to stop
The most dangerous phase of most real attacks isn't the initial breach — it's what happens after. Once an attacker has a foothold inside the network, they move laterally: jumping from system to system, escalating privileges, mapping the environment, reaching higher-value targets. This is where the absence of internal layers becomes catastrophic.
In a flat network — no internal segmentation, every host able to reach every other host — lateral movement is trivially easy. Compromise a developer's laptop, and from there you can reach the database server, the domain controller, the backup systems. Compromise any one thing and you have everything.
Network segmentation is the internal layer that stops this. Put the database servers on their own VLAN with a firewall rule that only the application servers can reach them. Put HR systems on a segment that finance can't touch. Put production completely separate from development. A compromised developer's laptop in a segmented network is a contained incident. In a flat network, it's a full breach.
SolarWinds — lateral movement at scale
The 2020 SolarWinds attack is the defining example of lateral movement done at nation-state sophistication. Attackers inserted malicious code into a software update that went out to 18,000 organisations. Once inside, they moved slowly and carefully — mimicking legitimate admin behaviour, using native tools, staying below detection thresholds for months. Organisations with strong internal segmentation limited what the attackers could reach. Those with flat architectures gave them everything.
Compensating controls — when a layer can't be fixed
Not every vulnerability can be patched immediately. Legacy systems can't always be updated. Business requirements sometimes force a control to be weaker than ideal. Compensating controls are the defense-in-depth answer to this problem: if you can't fix the vulnerable layer, strengthen the layers around it.
A hospital running a medical device on Windows XP — unpatched, unsupported, unfixable — can't simply upgrade it without recertifying the device. The compensating control approach: isolate the device on its own network segment with firewall rules that allow only the specific traffic it needs. Add network monitoring on that segment. Disable all unused ports and services on the device itself. Log every connection. The device is still vulnerable. The compensating controls make exploiting it significantly harder and far more likely to be detected.
Prevention vs detection — both are required
A common mistake in building layered defences is stacking only prevention controls — firewall rules, access controls, endpoint protection. Prevention is the priority, but detection has to be there for when prevention fails. An IDS watching internal traffic, a SIEM correlating log events, an alerting rule that fires when a user account suddenly accesses a hundred files in ten minutes — these don't stop the attack, but they cut the attacker's dwell time from months to hours. Dwell time is the measure of how long an attacker operates undetected. Shorter dwell time means less damage.
Layered defence in a real firewall config
Here's what network segmentation looks like in practice — a set of iptables rules enforcing the boundary between a DMZ, an application tier, and a database tier. Each zone is isolated; traffic between them requires explicit permission.
#!/bin/bash
# Layered network segmentation — iptables rules
# Three zones: DMZ (web), APP (application), DB (database)
# Traffic flows in one direction: internet → DMZ → APP → DB
# No zone can initiate connections backward up the chain
# ── Default: drop everything unless explicitly permitted ──
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
# ── Allow established/related sessions (stateful) ──
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
# ── Internet → DMZ: HTTPS only on web servers ──
iptables -A FORWARD -i eth0 -o eth1 -d 10.0.1.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -d 10.0.1.0/24 -p tcp --dport 80 -j ACCEPT
# ── DMZ → APP: web servers reach app servers on port 8080 only ──
iptables -A FORWARD -i eth1 -o eth2 -s 10.0.1.0/24 -d 10.0.2.0/24 -p tcp --dport 8080 -j ACCEPT
# ── APP → DB: app servers reach database on port 5432 only ──
iptables -A FORWARD -i eth2 -o eth3 -s 10.0.2.0/24 -d 10.0.3.0/24 -p tcp --dport 5432 -j ACCEPT
# ── Block everything else between zones (log before dropping) ──
iptables -A FORWARD -j LOG --log-prefix "DROPPED_FORWARD: " --log-level 4
iptables -A FORWARD -j DROPWhat just happened
The default policy drops everything — nothing moves unless there's an explicit rule permitting it. The rules form a strict one-way chain: internet traffic reaches only the DMZ web tier; DMZ servers can only call the app tier on one port; app servers can only reach the database on one port. An attacker who compromises a web server in the DMZ cannot directly reach the database — they'd have to compromise the app tier first. The final two lines log every dropped packet before discarding it, feeding detection rather than just blocking silently.
Instructor's Note
Teams often treat defense in depth as something to implement once and forget. It isn't — it requires ongoing attention. Controls get disabled for convenience and never re-enabled. Network segments get bypassed to "temporarily" fix a connectivity issue. Monitoring rules get tuned down because they were generating too many alerts, then never tuned back up. The architecture degrades quietly until it fails loudly. Defense in depth isn't a project. It's a maintenance habit.
Practice Questions
An attacker gains access to a developer's workstation through a phishing email. Because all internal systems are on the same flat network, they pivot to the database server within minutes. Which missing defense-in-depth layer allowed this lateral movement?
A legacy medical device cannot be patched. The security team isolates it on a dedicated VLAN, restricts its outbound traffic to a single IP, and adds monitoring on all connections to it. These measures are an example of what?
Detection controls don't stop an attack — they reduce the time an attacker operates inside a network undetected. What is the term for this window of undetected attacker presence?
Quiz
Defense in depth does not make a system impossible to breach. What does it actually achieve, and why is that still valuable?
In the iptables config shown in this lesson, the last two rules log before dropping all unmatched forwarded traffic. Why is the log step significant from a defense-in-depth perspective?
An attacker calls an employee, impersonates IT support, and convinces them to reveal their password. Every technical layer — firewall, endpoint protection, MFA prompt — was bypassed entirely. Which defense-in-depth layer was the point of failure?
Up Next · Lesson 9
Security Best Practices
The controls that show up on every audit, every checklist, and every breach post-mortem — and the reasoning behind each one.