Defense in Depth (Layered Security) | AP Cybersecurity
Defense in Depth: Layered Security Explained
Defense in depth is a layered security strategy: instead of relying on one control, you stack several so that if one fails, others still protect the asset. Topic 2.1 asks you to explain why this approach works.
Contents
Why layering works
No single control is perfect. A password can be phished, a lock can be picked, a firewall can be misconfigured. Defense in depth assumes any one layer might fail and adds others behind it so an attacker has to defeat several controls, not one.
Layering also buys time: each layer slows the attacker and creates more chances to detect them before they reach the asset.
A building uses a fence, badge access, a locked server room, and encrypted drives. Why is this stronger than any single control?
Reveal answer
Defense in depth. If an attacker gets past the fence and badge, the locked room and encryption still protect the data. One failure does not breach everything.
Defense in depth is about redundancy of controls. The key phrase: one control failing should not, by itself, grant access to the asset.
Layers can be any control type
Layers can mix physical (fences, locks), technical (firewalls, encryption), and managerial (policies, training) controls. The strength comes from variety: different layers fail in different ways, so one weakness does not unlock the rest.
This connects to the previous concept: defense in depth is how you combine the control types into a resilient whole.
A network has a firewall, network segmentation, and intrusion detection. If the firewall is misconfigured, what still helps?
Reveal answer
Segmentation limits how far an intruder can spread, and intrusion detection can still catch them. The remaining layers contain and reveal the attack.
Why one control is never enough
The 2013 Target breach began with a stolen vendor credential and spread widely because internal segmentation was weak. Stronger layered controls would have contained it. Defense in depth is the lesson.
One failure should not breach the whole system.
Key Terms
| Defense in depth | Layering controls so one failure is not a breach. |
| Layer | A single control in a stack of safeguards. |
| Single point of failure | A control whose failure breaks everything. |
| Redundancy | Backups and overlap so a failure is survivable. |
Match It Up
Common Mistakes
Relying on one strong control
A single control, however strong, is a single point of failure.
Thinking layers must all be technical
Layers can be physical, technical, or managerial; variety is the point.
Assuming layering blocks every attack
Defense in depth reduces and slows attacks; it does not guarantee none succeed.
Stacking identical controls
Layers should fail differently; redundant copies of the same weak control add little.
Check for Understanding
Frequently Asked Questions
Get in Touch
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
Prefer email? Reach me directly at [email protected]