Defence in Depth

Lesson plan

Level

Beginner

Time

About 80 minutes; the steps below add up to 79

Learners start from a house whose only lock is picked and list what else could have protected it, which gives them the four jobs (prevent, detect, respond, recover) before they are named. The phishing email is then followed twice, with one control and with four, after learners predict how the endings differ. Each later layer opens with a decision or prediction: which update to install first, what two weak clues mean together, why “completed” backups might fail, and how many protections one stolen keycard defeats. The habit to build: for every control, ask which job it does, what it depends on, and who acts on it.

Objectives

• Explain defence in depth as several different safeguards that fail separately
• Name the four jobs a control can do: prevent, detect, respond and recover
• Follow one attack through layered controls and say where each helps and what it leaves open
• Explain why monitoring needs a response and backups need testing
• Spot when apparently separate layers share one weakness

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Attack Chain and Least Privilege lessons first.
• Draw four columns on the board for the house answers, to be headed prevent, detect, respond and recover in the second step.
• The lesson takes about 79 minutes. To teach it in two parts, stop after “Patching, segmentation and endpoint controls”; the second part opens with “Everyday device security”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain defence in depth as several different safeguards that fail separately
   • Name the four jobs a control can do: prevent, detect, respond and recover
   • Follow one attack through layered controls and say where each helps and what it leaves open
   • Explain why monitoring needs a response and backups need testing
   • Spot when apparently separate layers share one weakness

   Purpose: Learners start from a house whose only lock is picked and list what else could have protected it, which gives them the four jobs (prevent, detect, respond, recover) before they are named. The phishing email is then followed twice, with one control and with four, after learners predict how the endings differ. Each later layer opens with a decision or prediction: which update to install first, what two weak clues mean together, why “completed” backups might fail, and how many protections one stolen keycard defeats. The habit to build: for every control, ask which job it does, what it depends on, and who acts on it.

2. 1. When the lock fails Think 5 min

   Purpose: Find the four jobs of a control from a familiar situation.

   Ask

   • The lock is picked. What else could have protected the house, or limited the harm?

   Responses to expect

   • Alarm, neighbours, CCTV, a dog, insurance, a safe. Sort them into four unlabelled columns.
   • On screen in turns: the opening question, its answer.

   Discussion pause: Collect answers before revealing the explanation.

   In the lesson window

   • Think it through: Suppose the front-door lock is the only thing protecting a house, and a burglar picks it. What else could have protected the house, or limited the harm?

3. 2. The idea Explain 8 min

   Purpose: Name defence in depth and the four functions, and state where the house comparison stops.

   Ask

   • The smoke detector: which job?

   Responses to expect

   • Some say preventative; ask what the detector itself stops.
   • On screen in turns: the opening; then the house, starting with the lock; the alarm; the neighbour; insurance, and how each covers the one before; defence in depth, starting with the preventative control; the detective control; the responsive control; the recovery control, and what layers do not promise; the check question on the smoke detector, and its answer; where the house comparison stops.

   In the lesson window

   • Check your understanding: A smoke detector in a server room sounds an alarm when a cable starts to burn. Which of the four jobs is it doing?

4. 3. A layered example Predict 10 min

   Purpose: Follow the same email with one control and with four, and see why the second layer held.

   Ask

   • How could the two endings differ? Ask for a prediction before showing the example.
   • Why did the phone code hold when the filter failed?

   Responses to expect

   • The key point: the second layer did not share the first one's weakness.
   • On screen in turns: the opening question, its answer; then the same email with one control; the same email with four layers; why the four functions overlap, and one control doing two jobs.

   Discussion pause: Show the first telling, then ask the class to write the four-layer ending before revealing it.

   To go further

   • Which single layer in the second telling would you least want to lose, and why?

   In the lesson window

   • Think it through: In both versions, the email filter misses the phishing email and Ms Okoro, in the school office, types her password into the fake page. Predict how the two endings could differ.

5. 4. Follow the attack with defensive decisions Experiment 7 min

   Purpose: Map complementary controls and their remaining gaps onto every stage of the attack chain.

   Ask

   • Pick a stage: two controls that work there, and one gap they leave.

   Responses to expect

   • Gaps are the hard part; push for what an attacker could still do.
   • The controls and gaps are held back: let groups each take one stage and fill in its row before revealing.
   • On screen in turns: the opening question, its answer; then the stages of the attack, with their controls held back; the controls at each stage, and what they leave open; how the rest of the lesson is ordered.

   Discussion pause: Let pairs fill one row before comparing with the table.

   In the lesson window

   • Think it through: Before reading the table: pick one stage of the attack chain and name two different controls that could work there, and one thing they would still leave open.

6. 5. Authentication and appropriate access Explain 6 min

   Purpose: Show that MFA quality and coverage matter, and that sign-in is separate from permission.

   Ask

   • MFA for everyone except the administrators: well protected?

   Responses to expect

   • Some accept “they are careful”; ask which accounts an attacker wants most.
   • On screen in turns: the opening; then why switching MFA on is not the end of the question; the check question on the administrators left out, and its answer; why signing in is only the first check.

   Misconceptions to challenge

   • A learner may believe: “MFA is enabled, so authentication is solved.” Respond: Method, coverage and recovery all matter, and MFA does nothing about broad permissions.

   In the lesson window

   • Check your understanding: A college turns on MFA for every member of staff except its two administrators, “because they are careful”. Is sign-in now well protected?

7. 6. Patching, segmentation and endpoint controls Predict 6 min

   Purpose: Prioritise patching by exposure, and explain segmentation and endpoint protection.

   Ask

   • Only one update tonight: which first?

   Responses to expect

   • Most choose the remote-access service; ask them to say why in terms of who can reach it.
   • On screen in turns: the opening question, its answer; then patching; segmentation; endpoint protection.

   Misconceptions to challenge

   • A learner may believe: “A firewall blocks malicious traffic.” Respond: It enforces its rules; permitted traffic can still be malicious.

   In the lesson window

   • Think it through: Tonight there is time to install only one of two updates. One fixes an easy-to-use flaw in the internet-facing remote-access service; the other fixes a flaw in a printer that only staff inside the building can reach. Which goes first?

8. 7. Everyday device security Explain 4 min

   Purpose: Connect five everyday practices to the four functions.

   Ask

   • Which of the five practices is the one most often skipped where you have worked or studied?

   Responses to expect

   • Updates and standard accounts are the usual answers.
   • The main function of each practice is held back: ask the class to name it first.
   • On screen in turns: the opening; then five everyday practices, with their functions held back; the main function of each practice; applying the practices consistently.

9. 8. Monitoring needs a response Predict 6 min

   Purpose: Show that alerts matter only when someone acts, and how weak clues combine.

   Ask

   • One refused sign-in, one fake-page report: what do they mean together?

   Responses to expect

   • Some dismiss both; ask whether they concern the same account and morning.
   • On screen in turns: the opening question, its answer; then why a log or an alert is not enough; fitting the response to the incident; where responsibilities are documented.

   If the explanation does not land: A smoke alarm in an empty building protects nothing: detection matters only when someone hears it and knows what to do.

   In the lesson window

   • Think it through: An IT technician sees one refused sign-in from another country. Separately, a member of staff reports a fake sign-in page. What should the technician make of the two together?

10. 9. Backups and recovery Predict 6 min

    Purpose: Show the three conditions for a backup to work, and its limit.

    Ask

    • Backups always say “completed”. What could still go wrong?

    Responses to expect

    • Untested restores and reachable backups are the two most often found.
    • On screen in turns: the opening question, its answer; then three things that decide whether a backup works, starting with reach; whether a restore has been tried; whether the way in is closed; what backups cannot undo.

    Misconceptions to challenge

    • A learner may believe: “Good backups mean a breach does not matter.” Respond: They restore availability; they cannot undo disclosure.

    In the lesson window

    • Think it through: The school’s backups run every night and always report “completed”. What could still stop them getting the school back after ransomware?

11. 10. Quality over quantity Predict 9 min

    Purpose: Discover that layers sharing one dependency can fail together, then see it in the school.

    Ask

    • One stolen keycard: how many protections can the thief get past?
    • What single change would make the school's three layers independent?

    Responses to expect

    • Some count each device as a layer; ask what controls each one.
    • Diagram: compare the shared and separated versions of the same three layers; ask what one stolen password reaches in each.
    • On screen in turns: the opening question, its answer; then the school’s story told a third time; three layers or one: the shared dependency; the fix: separate control for each layer; what makes a layer worth having; three questions to ask of a new control.

    Misconceptions to challenge

    • A learner may believe: “More products means more layers.” Respond: Layers count only if they fail separately.

    To go further

    • Find a shared dependency other than an account: for example one network link or one supplier.

    In the lesson window

    • Think it through: A shop has a burglar alarm, security cameras and a safe. All three are switched on and off with one master keycard, which is stolen from the manager’s car. How many of the three protections can the thief now get past?

12. 11. Apply it in a new situation Apply 4 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The dashboard tests detection without response; the attached drive tests a backup that shares the computer's weakness.
    • On screen in turns: the opening question, its answer; then the question on the backup drive, and its answer.

    In the lesson window

    • Apply it: A charity buys a monitoring tool that shows unusual sign-ins on a dashboard. Nobody has been asked to look at it. What does the tool add to the charity’s defences?
    • Apply it: A small business backs up its files every night to a second drive that is always plugged into the same computer. Ransomware encrypts the computer. What is the likely problem?

13. 12. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The patching-limit question is true or false; the answer is false.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

14. 13. What to remember Consolidate 3 min

    Purpose: Summarise the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: name the four jobs and one control for each.

    Responses to expect

    • For example MFA, alerts, account lockout, tested backups.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

15. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Several different safeguards, arranged so that one failure is survivable.
    • Prevent, detect, respond, recover: and one control may do more than one.
    • Protect the most powerful accounts first, and fix the most exposed weaknesses first.
    • An alert without a responder, or a backup never restored, protects little.
    • Check what each layer depends on; a shared dependency can turn three layers into one.

Consolidation

• Several different safeguards, arranged so that one failure is survivable.
• Prevent, detect, respond, recover: and one control may do more than one.
• Protect the most powerful accounts first, and fix the most exposed weaknesses first.
• An alert without a responder, or a backup never restored, protects little.
• Check what each layer depends on; a shared dependency can turn three layers into one.