Defence in depth vs Perimeter security

Fundamentals

Stacking several independent layers of protection so that when one fails, the next one still stops the attacker.

Formal

A design principle that combines several different controls - technical, organisational and physical - at different points, so that no single failure leaves an asset unprotected.

In plain English

Like protecting a home with a locked gate, a locked door, an alarm and a safe for the valuables - a thief who gets past one still meets the next.

In practice

At a Danish shipping company, a phishing mail slips past the mail filter and a clerk clicks the link, but MFA stops the stolen password from being used and EDR on the laptop blocks the download.

Why it matters

Every control fails sometimes, so relying on just one means a single mistake is enough for a breach.

Perimeter security

Fundamentals

Guarding the edge between an organisation's own network and the outside world, and trusting what is already inside.

Formal

A security model that places its main controls, such as a firewall and VPN, at the border of the internal network. Traffic is checked on the way in or out, while users and machines inside the border are largely trusted by default.

In plain English

A castle with thick walls and one guarded gate - once you are past the gate, you can walk into almost any room.

In practice

A municipality lets every office PC reach every server freely because they all sit behind the firewall, so one infected laptop brought in by an employee can reach the payroll system.

Why it matters

With cloud services and remote work there is no longer one clear edge to guard, and an attacker who gets inside meets little resistance.

Shared connections

Zero Trust