Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Defence in Depth and Zero Trust
Don’t rely on one wall
Every control eventually fails: a patch is missed, a password is phished, a rule is misconfigured. Good architecture assumes this. Defence in depth adds independent layers. Zero trust stops treating anything as safe just because of where it sits on the network.
Defence in depth
Layers typically span policies and people, physical security, the network, endpoints, applications and the data itself. An attacker has to beat all of them; defenders get several chances to stop or detect the attack.
What makes layers work
- Independent: a failure in one doesn’t disable the others. Two firewalls managed from the same rule set aren’t really two layers.
- Mixed types: preventive, detective and corrective controls together.
- Covering the attack path: each stage of an attack meets at least one control.
- Proportionate: more layers for more valuable assets.
Zero trust
The traditional perimeter model trusts anything inside the network. Once an attacker gets in, often through a phished password or a VPN, they can move freely. Zero trust (described in NIST SP 800-207) removes that implicit trust:
| Principle | In practice |
|---|---|
| Verify explicitly | Every request is checked: identity, device health, location, behaviour |
| Least-privilege access | Access to specific applications, not whole networks; just-in-time where possible |
| Assume breach | Segment to limit movement; monitor continuously; encrypt everywhere |
Identity becomes the main control plane, so strong authentication and device health checks are foundations.
Adopting zero trust in stages
Zero trust is a strategy adopted over time, not a product bought in one go:
- Identity: strong MFA and a single identity provider.
- Devices: an inventory and health checks.
- Access: per-application, least-privilege access instead of full-network VPN.
- Segmentation: micro-segmentation to limit lateral movement.
- Monitoring: continuous verification and analytics.
Example. A company replaces its full-network VPN with per-application access through an identity-aware proxy. When a contractor’s laptop is later compromised, the attacker reaches one web app instead of the whole network.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Purpose of defence in depth | One control’s failure doesn’t lead to compromise |
| Core idea of zero trust | Never trust because of location; always verify |
| Main control plane in zero trust | Identity, plus device health |
| Zero trust principle about attackers | Assume breach |
| How zero trust is adopted | Gradually, as a strategy, not as one product |
In short
- Defence in depth layers independent controls (people, physical, network, endpoint, application, data) so a single failure doesn't lead to compromise.
- Layers should include preventive, detective and corrective controls, and should be genuinely independent.
- Zero trust removes implicit trust based on network location: every request is verified using identity, device and context.
- Zero trust principles: verify explicitly, least-privilege access, assume breach.
- Identity becomes the main control plane; strong authentication and device health checks are foundations.
- Zero trust is a strategy adopted in stages, not a product bought in one go.
Exam traps
- Two firewalls from the same rule set aren't really two layers; layers should be independent.
- Zero trust doesn't mean trusting nobody to do anything; it means verifying every access.
- A VPN that gives full network access is the opposite of zero trust.
- No vendor sells 'zero trust in a box'; it's an architecture and a journey.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Defence in depth
Zero trust