Lessons · Cybersecurity · defence in depth
More than one wall
Defence in depth means several controls in layers, so that when one fails, the next one still holds.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The phishing email got through the filter. The user clicked. The malware ran. And then it could not reach the file server because the account had no rights to it, and the backup restored what it did touch. Four controls failed or were skipped; the fifth and sixth held. That is a normal Tuesday, not a disaster.
How to think about it
For any asset, list the controls between the attacker and it, from outside in. If the list has one entry, that entry will fail one day and there is nothing behind it.
Worked example
Layer 1: the email filterCatches most of it. Not all.
Layer 2: the trained personReports what the filter missed. Not always.
Layer 3: the endpoint protection on the laptopStops most malware. Not the newest.
Layer 4: least privilege on the accountThe malware runs as a user who cannot reach the server. This is the layer that held.
Layer 5: the backupAnd if it had not, the data comes back.
Your turn
Write the name of the principle that puts several controls in layers so one failing is not the end.
principle:
Solve one, graded on the server
The trap
Buying a better first wall instead of a second one. A perfect filter does not exist; a filter plus a trained person plus least privilege does.