Defence in depth

A castle did not rely on a single wall. It had a moat, a wall, a gate, guards and a keep. If the moat failed, the wall was next. Security uses the same idea, called defence in depth: several independent layers, so that when one fails, another still stands.

Here are six layers a school or a small company might use:

• People: awareness, clear rules, someone to ask.
• Perimeter: the edge between the outside and the inside, such as a firewall and locked doors.
• Network: how the inside is divided and watched.
• Devices: updates, screen locks, antivirus, disk encryption.
• Applications: sign-in checks, safe settings, up-to-date software.
• Data: backups, encryption, and rules about who can open what.

Why layers work: the multiplication rule. Suppose a threat has a 50 % chance of getting past each layer, and the layers behave independently (one failing does not make another fail). To get all the way in, the threat must pass every layer:

• 1 layer: 0.5 = 50 %
• 3 layers: 0.5 × 0.5 × 0.5 = 12.5 %
• 5 layers: 0.5 to the power 5 = about 3 %

Even a set of mediocre layers beats one strong wall. If a single wall lets only 10 % through, two layers that each let 30 % through give 0.3 × 0.3 = 9 %, and a third 30 % layer brings it to 2.7 %. And a single wall has a different weakness: when it fails, nothing else is left.

Be honest about the limits of this arithmetic. Real layers are not perfectly independent. If staff are tricked into giving away a password, several layers that all trust that password fall together. So layers should be different in kind (a person, a lock, a log), not three copies of the same thing.

Six jobs of a defence. The US standards institute NIST describes its Cybersecurity Framework with functions. Version 2.0 (2024) names six:

• Govern: decide the rules, roles and priorities.
• Identify: know what you have and what could go wrong.
• Protect: put safeguards in place.
• Detect: notice when something is happening.
• Respond: act on an incident.
• Recover: restore normal work and learn from it.

They are not a ladder you climb once. They are jobs a security team does all the time. This course visits them in turn: this world is mostly Govern and Identify, worlds 2 to 4 are Protect and Detect, and world 5 is Respond and Recover.