Defence in Depth and Network Segmentation

Priya asks, "We have a firewall on the router now. Are we done?" Every single defence fails sometimes: a password gets guessed, a patch is missed, someone clicks. The question is what stands behind it when it does.

The rule

Stack independent layers, so one failure is never the whole story.

Defence in depth means protecting an asset with several layers that fail in different ways. Think of a castle: moat, wall, gate, guards, locked keep. A typical stack around the shop's customer data:

• People — staff trained to spot phishing.
• Network — firewall, separate networks, closed ports.
• Device — updates, antivirus, disk encryption.
• Account — strong passwords, MFA, least privilege.
• Data — encryption, backups.
• Detection — logs and alerts, so a breach is noticed.

A key network layer is segmentation: splitting one flat network into separate zones so that a problem in one cannot easily spread.

• The perimeter is the edge between your network and the internet, usually the router and firewall.
• A DMZ (demilitarised zone) is a middle zone for things the public must reach, like a web server, kept apart from the internal network.
• Internal segments separate groups of devices from each other: staff, till, guests, cameras.

If the guest Wi-Fi is compromised, segmentation means the attacker is standing in the lobby, not in the office.

The shortcut

Pick one asset and ask "If this layer fails, what is the next one?" Keep asking until you reach the data. If the answer is ever "nothing", add a layer there.

The trap is a "hard shell, soft middle" network: strong perimeter, but once inside, everything can reach everything.

Drills

Answer fast — trust the rule.

Remember

• Stack independent layers, so one failure is never the whole story.
• Ask "if this layer fails, what is next?" until you reach the data.
• Segment the network: perimeter, DMZ for public systems, separate internal zones. Trap: hard shell, soft middle.