Study Guide
Defence in Depth
Connect prevention, detection, response and recovery to a fictional attack without relying on any single safeguard.
Lesson 2.4 Threats, Vulnerabilities & Defence
Every control can fail: a filter misses an email, a password is stolen or a patch is late. This lesson is about arranging controls so that one failure does not decide the outcome.
Stage: Think
When the lock fails
Think it through
Suppose the front-door lock is the only thing protecting a house, and a burglar picks it. What else could have protected the house, or limited the harm?
- Hint 1: What would let someone know the burglar was inside?
- Hint 2: Who would act on that?
- Hint 3: What would help put things right afterwards?
Show what happens
Most lists include an alarm, someone who hears it and calls for help, and insurance or a record of what was owned. Each one covers a failure of the one before, and each does a different job.
Stage: Explain
The idea
Think about how a house is protected. Nobody relies on the front-door lock alone.
- The lock keeps most people out. It prevents.
- The alarm goes off if someone gets past the lock. It detects.
- A neighbour hears the alarm and calls the police. That is the response.
- Insurance, and photographs of what you owned, let you put things right afterwards. That is recovery.
Each one covers a failure of the one before. A lock that is picked does not matter so much if the alarm works. An alarm nobody hears is useless, which is why the neighbour matters.
Defence in depth is the same idea applied to computer systems: several different safeguards, arranged so that when one fails another is still standing. The four jobs have the same names.
- A preventative control stops something happening.
- A detective control makes it visible when it happens anyway.
- A responsive control limits the harm while it is going on.
- A recovery control restores things afterwards.
None of them promises that every attack will be stopped. Together they make one failure survivable.
Check your understanding
Show the answer
Answer: B. Detective: it makes the problem visible.
Detective. It makes the fire visible; someone still has to respond, and recovery comes later.
Where the comparison stops. A burglar has to get past the lock and then the alarm, in order. A computer attacker can sometimes go round a layer entirely, or find that one stolen administrator password switches several layers off at once. The last section of this lesson, on quality, deals with that.
Stage: Predict
A layered example
The school from Attack Chain lets staff sign in from home to a remote-access service and use the pupil records system. Follow the same phishing email twice: once when the school relies on a single control, and once when it has four layers.
Think it through
In both versions, the email filter misses the phishing email and Ms Okoro, in the school office, types her password into the fake page. Predict how the two endings could differ.
- Hint 1: In the first version, nothing else stands between the attacker and the records.
- Hint 2: In the second, what might the remote-access service ask for besides a password? Who might notice?
Show what happens
With one control, its failure decides everything. With four layers, the next layer has a chance to hold, and someone has a chance to notice and act. The example shows both endings.
First telling: one control. The school relies on its email filter to keep phishing out.
- A phishing email arrives. It uses a brand-new fake website, so the filter does not recognise it and lets it through.
- Ms Okoro, in the school office, follows the link and types her password into the fake sign-in page.
- The attacker signs in to the remote-access service with her username and password. Nothing else is asked for.
- The attacker opens pupil records. Nothing tells anyone that it is happening.
Outcome: one control failed, and that failure decided everything.
Second telling: four layers. The email and the filter are exactly the same.
- Prevent (fails). The filter misses the email, and Ms Okoro types her password into the fake page, just as before.
- Prevent (holds). The remote-access service also asks for a code from Ms Okoro’s phone. The attacker has her password and not her phone, so the sign-in is refused.
- Detect. A refused sign-in from another country raises an alert to the school’s IT technician. Ms Okoro, uneasy about the page, also reports the email.
- Respond. The technician resets her password, ends any sessions open on her account, confirms that no sign-in succeeded, and removes the same email from eleven other staff mailboxes before anyone else follows the link.
- Recover. Nothing was lost this time, so there is nothing to restore. If files had been locked or deleted, a tested backup would be the way back.
Outcome: no records were read. The first layer failed in exactly the same way in both tellings. The result was different because the next layer did not share its weakness: the filter judges emails, and the code depends on a phone.
Apply these functions across people, processes and technology. They overlap; they are not four products or a promise that an incident passes through tidy stages.
- Preventative · Reduce opportunities
Filter deceptive messages, ask for more than a password, fix known weaknesses and restrict access. These controls can fail or be bypassed, so later safeguards still matter.
- Detective · Make misuse visible
Record sign-ins and access, notice what is unusual, and send alerts to someone able to investigate.
- Responsive · Limit ongoing harm
Follow an agreed process to lock affected accounts or disconnect affected devices, end their access and keep the evidence.
- Recovery · Restore trusted operation
Use protected backups and a tested recovery process. Fix the cause and check restored services; restoration cannot undo disclosure of stolen data.
The four functions apply across people, processes and technology, as the second telling showed: a code from a phone, a member of staff who reported the email, and a technician with an agreed process. They overlap, and they are not four products, nor stages that every incident passes through in order.
One control can do more than one job. Security software on a computer may block a malicious program (preventative) and raise an alert about it (detective). The useful question is what the control does in this situation, not which single label it must always carry. Security Controls: Categories and Functions sets out the wider classification, with four categories and six functional types, and shows how it lines up with the four functions used here.
Stage: Experiment
Follow the attack with defensive decisions
The worked example stopped the attack at the second stage. The table takes every stage of the path in Attack Chain and gives the controls that work together there, and what they still leave open.
Think it through
Before reading the table: pick one stage of the attack chain and name two different controls that could work there, and one thing they would still leave open.
- Hint 1: Choose a stage you remember well, such as credential theft.
- Hint 2: What could an attacker still do if both controls held?
Show what happens
Compare your answer with the row for that stage below. Most rows pair one control that prevents with one that makes misuse visible, and each row ends with a gap that the next layer must cover.
Comparison table: scroll horizontally on narrow screens.
| Attack opportunity | Complementary controls | What still needs attention |
|---|---|---|
| Phishing reaches a staff member | Email filtering, clear guidance and an easy way to report. | Some messages pass filters; people need a workable way to check requests and report concerns. |
| Credentials are disclosed | MFA, a different password for each service, and prompt handling of a reported disclosure. | A stolen password is not yet a successful sign-in, but MFA methods differ in strength and open sessions must be ended separately. |
| Remote access is attempted | Allow remote access only for accounts and devices that need it, and review sign-in records. | A successful sign-in can look legitimate; being allowed in is not proof of honest use. |
| Internal discovery or access occurs | Least privilege, segmentation and monitoring of the systems that matter. | Check what accounts can actually reach; naming a network “staff” enforces nothing by itself. |
| Greater privilege is sought | Separate administrator accounts, keep them few, install updates and review changes to permissions. | An update does not remove excessive permissions or stop misuse of something an account is allowed to do. |
| Sensitive information is transferred | Restrict access and sharing, watch for unusual transfers and respond to them. | Honest and dishonest transfers can look alike. Restoring files does not take back an attacker’s copies. |
| Ransomware disrupts services | Security software on each computer, segmentation, a quick response, protected backups and a recovery plan. | A backup existing does not prove that it works or that the restored system is safe. |
The rest of the lesson takes the layers in the order the example met them: stopping a sign-in and limiting what it can reach, then noticing and responding, then recovering. It ends with the question that decides whether the layers are worth having.
Stage: Explain
Authentication and appropriate access
The layer that held in the example was MFA: signing in with two or more different kinds of proof. The three kinds are usually described as something you know (a password), something you have (a phone or a security key) and something you are (a fingerprint). Two passwords are still one kind, so they do not count as MFA.
“MFA is switched on” is not the end of the question. Which method is used, whether every account has it, and what happens when someone loses their phone all decide how much protection it really gives. The strongest methods are called phishing-resistant: there is no code the person could be tricked into typing into a fake page.
Check your understanding
Show the answer
Answer: C. No: the most powerful accounts are the ones left out.
No. Coverage is part of the question, and the gap is on the two accounts that could do the most harm if their passwords were stolen.
Signing in is only the first check. Authentication establishes who is signing in; authorisation decides what that person may then do. A member of staff who needs to read one document should not be able to administer the whole file server. Keeping administrator work in a separate account limits what an attacker gains from an everyday one, and reviewing access from time to time finds permissions that have outlived their purpose. Least Privilege explains this in full.
Stage: Predict
Patching, segmentation and endpoint controls
Think it through
Show the answer
Answer: B. The remote-access service: anyone online can reach it.
The remote-access service: an easy flaw that anyone on the internet can reach comes before one inside the building. Order matters because not everything can be updated at once.
Three more preventative layers limit what an attacker can do after getting in.
Patching means installing the updates that fix known weaknesses in software. Not everything can be updated at once, so the order matters: a weakness in a service that can be reached from the internet, and that is easy to use, comes before one buried inside the network. An update closes one door. It does nothing about a stolen account with too many permissions.
Segmentation divides the network into separate parts and allows only the connections between them that the work needs. Reaching the school’s remote-access service should not mean being able to administer the records system. The devices that enforce those rules are firewalls. A firewall allows whatever its rules allow, so traffic it permits can still be malicious.
Endpoint protection is security software installed on each computer (each “endpoint”), such as antivirus. It can block a malicious program, raise an alert about it and help to isolate the affected computer. It works alongside access and network controls and does not replace monitoring, patching or response. What Is a Network? and the rest of the Networking Fundamentals module explain how devices communicate, which is what segmentation and firewalls control.
Stage: Explain
Everyday device security
A few basic practices can significantly improve the security of individual devices. Each one is a layer in its own right, and each covers a gap the others leave:
Comparison table: scroll horizontally on narrow screens.
| Practice | What it does | Main function |
|---|---|---|
| Use a standard account for everyday work | Limits what malicious software or a mistake can change; see Least Privilege. | Preventative |
| Use strong passwords or passphrases | Makes guessing and reuse of credentials harder. | Preventative |
| Keep operating systems and applications updated | Patching removes known vulnerabilities; see Vulnerabilities and Exposure. | Preventative |
| Protect devices against malware | Blocks known malicious software and raises alerts about suspicious activity. | Preventative and detective |
| Enable and correctly configure firewalls | Allows only the network traffic that is needed. | Preventative |
Consider how consistently these practices are applied in real environments. Knowing a recommendation is not the same as applying it everywhere, every time; a practice applied to most devices still leaves the rest exposed.
Stage: Predict
Monitoring needs a response
Think it through
Show the answer
Answer: C. Together they are far stronger evidence than either.
Either clue alone might be innocent. Together, about the same account and the same morning, they point strongly at an attack, and someone must act on them.
A log records that something happened. An alert draws attention to it. Neither stops an attacker. In the example, the alert about the refused sign-in mattered only because it reached a technician who knew what to do with it.
So a school needs answers to three questions before anything goes wrong: who receives alerts, how they look into them, and who is allowed to lock an account or disconnect a computer. One odd sign-in may be innocent. Put together with Ms Okoro’s report of the fake page, it becomes strong evidence: connecting separate clues in this way is called correlating them.
A response has to fit the incident. Locking an account without telling anyone may stop a teacher taking a register; ignoring a confirmed break-in lets the harm continue. Deciding in advance who may do what avoids both.
Security Documentation explains how responsibilities, procedures and records support this work. People, Processes and Technology explains why a detection tool without a usable process and responsible people is an incomplete safeguard.
Stage: Predict
Backups and recovery
Suppose ransomware does lock the records system. A backup, a spare copy of the data, may be the way back.
Think it through
The school’s backups run every night and always report “completed”. What could still stop them getting the school back after ransomware?
- Hint 1: Could the attacker reach the backups as well as the records?
- Hint 2: Has anyone ever actually restored from them?
- Hint 3: What happens if you restore onto systems the attacker can still enter?
Show what happens
Three things: the attacker may be able to delete the backups too, a backup nobody has tested may not restore completely, and restoring onto systems the attacker can still reach invites a second incident. The list below takes each in turn.
Three things decide whether it is.
- Can the attacker reach the backup too? If the account that was taken over can also delete the backups, both are lost together. Copies kept disconnected from the network (offline), or stored so that they cannot be changed or deleted for a fixed time (immutable), avoid that.
- Has a restore ever been tried? “The backup job finished” shows that a copy exists. Only a practice restore shows that the data is complete, that everything the service depends on comes back with it, and how long it takes.
- Is the way in closed? Restoring onto systems the attacker can still enter invites a second incident. Reset the affected accounts and fix the weakness first.
Backups restore availability and can put correct information back. They cannot undo disclosure: if records were copied before they were locked, the copies are still out there. The CIA Triad and DAD Triad explain why those are separate outcomes.
Stage: Predict
Quality over quantity
Think it through
Show the answer
Answer: B. Possibly all three: one card controls them all.
All three, potentially. They looked like three layers, but they shared one dependency, the keycard, so one theft could defeat them together.
Tell the school’s story a third time. The school has all four layers, and its IT technician uses one administrator account for everything: it sets permissions on the records system, it manages the monitoring, and it runs the backups.
- An attacker obtains that one account’s password.
- With it, they give themselves access to the records system.
- With the same account, they switch off the alerts, so nobody is told.
- With the same account, they delete the backups.
Three layers were in place, and one stolen password removed all three. They were never independent: each depended on the same account.
A supplementary illustration of the school’s story told a third time. The same three layers are shown with shared and with separated control.
Shared dependency
One unrestricted admin account
- Production permissions (controlled by One unrestricted admin account)
- Security monitoring (controlled by One unrestricted admin account)
- Backups (controlled by One unrestricted admin account)
Compromise that one account and an attacker can change systems, hide the activity and delete the recovery route. Three layers behave like one.
Separated authority
- Production administratorsProduction permissions (controlled by Production administrators)
- Security teamSecurity monitoring (controlled by Security team)
- Separately protected backup accountBackups (controlled by Separately protected backup account)
Compromising one role affects one layer. Monitoring can still see the change, and backups can still restore it.
The fix is to give each layer its own control: different accounts for administering systems, for monitoring and for backups. Then taking over one of them leaves the other two working.
For each layer, ask what it is for, who owns it, and what shows that it works. Buying a control or writing a policy does not automatically reduce the risk that remains, called residual risk.
Usability matters here as well. A safe way of sharing files that staff cannot work out how to use pushes them towards unsafe ones, as Security, Usability & Functionality shows.
The goal is a set of controls that work together and fail separately, with evidence that they do. More products, more restrictions or more alerts do not achieve that by themselves.
When a new control is proposed, ask three questions: which of the four functions it adds, which existing layer it depends on, and who will act on what it finds. A control that only duplicates an existing layer, or produces alerts nobody reads, adds less than it appears to.
Stage: Apply
Apply it in a new situation
These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.
Apply it
- Hint 1: Ask what happens after the tool notices something unusual.
Show the answer
Answer: A. A detective layer, but no response, so little protection.
It can make misuse visible, but with nobody receiving or acting on what it shows, it adds very little. Detection needs a response.
Apply it
Show the answer
Answer: C. The ransomware can probably encrypt the backup too.
A drive that is always connected can be encrypted along with everything else. The backup needs to be offline or protected from change, and tested.
Stage: Check
Check your understanding
These questions come from the approved revision bank. Choose an answer and check it; the explanation and its sources follow.
Show answer
Answer: Phishing-resistant MFA appropriate to the service; Remote-access restrictions for authorised accounts and devices
MFA and access restrictions can make the password insufficient or restrict entry. They still need effective configuration; backups support recovery and VPN encryption does not establish permission.
Revision sources: Defence in Depth (Supplementary Study Guide explanation)
Show answer
Answer: Investigate promptly and contain inappropriate access under the response procedure.
Monitoring is detective. Investigation and proportionate containment turn evidence into response; an alert alone does not stop an attacker.
Revision sources: Defence in Depth (Supplementary Study Guide explanation)
Show answer
Answer: The controls share authority whose compromise could undermine them together.
A shared point of failure can defeat several nominal layers. Separate authority and protected recovery arrangements need evidence of effective operation.
Revision sources: Defence in Depth (Supplementary Study Guide explanation)
Show answer
Answer: False
Patching addresses relevant software vulnerabilities. It does not correct every excessive permission or prevent misuse of authorised application functions; access controls and monitoring remain important.
Revision sources: Defence in Depth (Supplementary Study Guide explanation)
Study and revision
Practise selected concepts through the topic overview, quiz and flashcards. Most of this revision is learning-only and is reached through the All topics track.
Stage: Consolidate
What to remember
- Defence in depth means different safeguards that fail separately, so one failure does not decide the outcome.
- Controls do four jobs: prevent, detect, respond and recover. One control can do more than one.
- Coverage and order matter: MFA on every powerful account, and the most exposed weaknesses patched first.
- Monitoring needs a response, and backups need protecting and testing. Neither undoes a disclosure.
- Layers that share one dependency, such as one administrator account, can fail together.
Key terms
- Defence in depth
Using several complementary layers of preventative, detective, responsive and recovery controls, so that one failure does not leave assets unprotected.
- Preventative control
A control that reduces the chance of an attack or mistake succeeding, such as restricting access or filtering deceptive emails.
- Detective control
A control that makes suspicious or unwanted activity visible, such as monitoring unusual sign-ins.
- Responsive control
A control or process that limits ongoing harm once a problem is found, such as containing a compromised account.
- Recovery control
A control that restores trusted, usable operation after an incident, such as restoring from protected, tested backups.
Common misunderstandings
Layers count only if they work independently. Controls that share one account, one network path or one administrator can fail together.
Methods differ, and coverage, account recovery and enforcement all matter. MFA also does nothing about permissions that are too broad.
A firewall enforces the rules it is given. Traffic that the rules permit can still be malicious.
Backups restore availability. They cannot undo disclosure of data that has already been stolen.
Further reading
The glossary of the US National Institute of Standards and Technology (NIST) defines defence in depth.
Lesson sources and acknowledgements
Sources and scope
The approved Session 1 Learning Log records reasoning about where controls can interrupt an attack. The supplied educational reference develops that reasoning into layered examples. This lesson is supplementary explanation, not a claim that every control below was taught in detail or that I implemented or tested it. Its school scenario continues the fictional example in Attack Chain. The everyday device-security practices were listed in Session 2. The Session 1 log establishes the recorded learning; the supplied reference supports these educational extensions.
The school, Ms Okoro, the technician and the three tellings of the incident are invented. They are not an incident-response procedure for a real school; no access review, recovery test or recovery time is reported, and none was carried out or measured. The house comparison, the three tellings, the shared-dependency diagram and the misunderstandings are supplementary explanations.
Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the opening question, every question asked in the lesson with its feedback and hints, the server-room, college, printer, shop-keycard, charity and small-business examples and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
Establishing or verifying a claimed identity, for example when a user signs in.
The security objective of keeping systems, services and information accessible to authorised users when required.
A measure intended to modify risk, for example by restricting access, detecting misuse or supporting recovery.
Using several complementary layers of preventative, detective, responsive and recovery controls, so that one failure does not leave assets unprotected.
A control that makes suspicious or unwanted activity visible, such as monitoring unusual sign-ins.
Information becoming accessible to an unauthorised party. Disclosure threatens confidentiality, even if the original information is unchanged.
A device at the end of a network connection that people or programs actually use: a laptop, desktop computer, phone, tablet or server.
Security software installed on each computer or phone to block malicious programs, raise an alert about suspicious activity and help to isolate an affected device. Antivirus is the best-known kind.
A control that allows or blocks network traffic according to configured rules.
Granting users, processes and systems only the access necessary to perform their authorised functions.
Malicious software designed to disrupt, damage or gain unauthorised access to devices, networks or data. Ransomware is one type.
Authentication that requires two or more different types of factor, such as something you know and something you have.
Applying updates from a software vendor that fix known vulnerabilities or other flaws.
The idea that effective security depends on trained, responsible people, repeatable processes and supporting technical controls working together.
A deceptive message designed to trick the recipient into an action, such as revealing sign-in details or opening a malicious link.
A document that sets organisational rules and expectations, defining what is and is not permitted.
A control that reduces the chance of an attack or mistake succeeding, such as restricting access or filtering deceptive emails.
Step-by-step instructions explaining how a particular task should be carried out.
Malicious software that denies access to systems or data, typically by encrypting them, in order to extort payment. Some incidents also involve data theft.
A control that restores trusted, usable operation after an incident, such as restoring from protected, tested backups.
A control or process that limits ongoing harm once a problem is found, such as containing a compromised account.
Uncertainty and potential harm to an organisation’s objectives, considering what could happen, how likely it is, the consequences and the organisation’s context.
Dividing an environment into parts, with enforced rules about which communication is allowed between them.
A device that connects devices within a local network and forwards Ethernet frames using the MAC addresses it has learned.
How effectively, efficiently and satisfactorily intended users can use a system to complete their tasks.
A weakness that a threat may exploit.
Your progress on this lesson
Saved in this browser only. It is not sent anywhere, does not follow you to another device, and is lost if you clear this site’s data.
This browser is not allowing the site to save progress, so it will be forgotten when you leave the page.