PlantUML DiagramDefense in Depth Layers
A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
A junior engineer asks: 'Why do we need a firewall, IDS, IPS, NAC, 802.1X, and host-based security? Isn't the firewall enough?' The answer explains the entire discipline of network security: no single control is enough, because attackers only need one gap.
Network security is about managing risk. Not eliminating it — that's impossible — but reducing it to a level the business can accept. Every control you add reduces some risk while adding cost and complexity. The art is picking the right controls for the actual threat model.
Every security control exists to protect one or more of these properties. Encryption protects confidentiality. Digital signatures protect integrity. Redundant links protect availability. When you evaluate a new security technology, ask which of the three it actually improves — and what it costs in the others.
Availability is often the forgotten leg of the triad. A network that's secure but down is useless. In practice, security controls can harm availability if not designed carefully — aggressive IPS rules block legitimate traffic, tight firewalls break applications, MFA outages lock out users. Balance all three.
Defense in depth assumes any single control can fail. The firewall has a bad rule? The IPS catches the traffic. IPS misses it? Segmentation limits lateral movement. Segmentation bypassed? Host security catches the payload. Every layer is a chance to detect and stop the attack.
| Aspect | Perimeter (Traditional) | Zero Trust |
|---|---|---|
| Trust model | Inside = trusted, outside = untrusted | No implicit trust — verify everything |
| Primary control | Firewall at the boundary | Identity + policy at every access point |
| Assumes | Attacker comes from outside | Attacker may already be inside |
| Works well for | On-prem, static workloads | Cloud, remote work, BYOD |
| Weakness | Once inside, everything is reachable | Complex to implement |
Perimeter security was the standard for decades. Castles had walls; networks had firewalls. But when users work from home, apps run in the cloud, and contractors need access, the perimeter dissolves. Zero trust acknowledges this reality: verify every access request, grant least privilege, assume breach.
Security is risk management, not risk elimination. CIA triad defines what to protect. Defense in depth assumes controls can fail. Zero trust rejects the perimeter model. Next lesson covers the specific threats you'll defend against.
Finish the lesson once you have worked through the material. This awards ★ 15 XP.