A remote employee's valid login can coexist with an infected laptop, excessive permissions, or an exposed database. Effective mitigation addresses each exposure through controls operating at the relevant boundary.
Layered security places complementary safeguards across network, host, application, identity, and data boundaries. Defense-in-depth coordinates those layers so that bypassing one safeguard leaves additional opportunities to prevent harm, detect activity, or limit consequences.
The layers protect different exposures.
- Network controls restrict traffic entering the organization and moving between internal zones.
- Host controls protect individual workstations, servers, and mobile devices against unsafe configurations and malicious execution.
- Application controls validate requests and enforce permitted functions within business software.
- Identity controls verify users and devices and limit their privileges.
- Data controls restrict access to sensitive records and protect stored information against unauthorized disclosure.
Two security products sharing an unrestricted administrator account may fail together when that account is compromised. Defense-in-depth therefore requires evaluating shared dependencies, coverage gaps, and whether remaining controls still protect the resource after another safeguard fails.
Common mistakes
- Tunnel scope overstated. VPN protection covers tunneled traffic; an infected endpoint still requires endpoint controls.
- Product name substituted for behavior. An alert-only appliance supplies no automatic blocking, regardless of its advertised prevention capability.
- Severity score controls priority. Actual exposure and business consequences can move an actively exploited payment-service weakness ahead of a higher-scored isolated weakness.
Bottom line
- Defense-in-depth combines complementary controls across boundaries and evaluates shared points of failure.
- Vulnerability management continuously inventories, identifies, prioritizes, treats, and verifies weaknesses.
- Preventive, detective, and corrective classifications follow the stated action, timing, and risk addressed.
- Least privilege limits authority, need-to-know limits information access, and zero-trust removes automatic trust based on network location.
Exam shortcut
Identify the threatened resource and the requested action first. A bandwidth-exhaustion stem points upstream; an unnecessary-service stem points toward hardening. Underline the operative verb: alert, block, quarantine, repair, or restore. When a stem changes one appliance setting, reevaluate that action before carrying forward its earlier classification. Sort authentication evidence into knowledge, possession, and inherence. Count distinct categories only after confirming that the mechanism verifies each factor.
The full lesson (about 5,073 words, 34 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.B2
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.