Quick answer: Layered cyber security, also called defense in depth, protects an organization with several independent layers of controls so that if one fails, others still stop or detect the attack. Common layers are people and policy, the network perimeter, the internal network, endpoints, identity, applications, data, and monitoring with incident response.
No single control is perfect. Firewalls can be misconfigured, staff can click a phishing link and software can contain unknown flaws. Layering controls means an attacker must defeat several defenses in a row, which gives you more chances to catch them. This guide explains each layer and how to apply the approach.
The layers of cyber security
| Layer | Purpose | Example controls |
|---|---|---|
| People and policy | Reduce human error and set rules | Awareness training, acceptable use policy |
| Perimeter | Filter traffic entering and leaving | Firewalls, email and web filtering |
| Internal network | Limit movement inside the network | Segmentation, intrusion detection |
| Endpoint | Protect devices | EDR, patching, device encryption |
| Identity | Verify users and limit access | MFA, least privilege, privileged access management |
| Application | Secure software | Secure coding, web application firewalls |
| Data | Protect information itself | Encryption, data loss prevention, backups |
| Monitoring and response | Detect and contain attacks | SIEM, alerting, incident response plan |
Each layer covers gaps in the others. For example, multifactor authentication still protects an account after a password is stolen by phishing, and backups still recover data after ransomware gets past endpoint defenses.
Why layered security works
Attacks happen in stages, from reconnaissance to the final objective. Each layer creates an opportunity to break that chain, an idea explained in our guide to the Cyber Kill Chain. CISA and the NSA describe defense in depth as a core principle, and the CISA cybersecurity best practices reflect it throughout.
How to build a layered defense
- Map your assets and risks so each layer protects what matters most.
- Cover the basics in every layer before buying advanced tools: MFA, patching, backups, endpoint protection and logging.
- Segment the network to slow lateral movement; see network segmentation vs microsegmentation.
- Avoid single points of failure, such as one admin account that controls everything.
- Monitor across layers so alerts from different tools can be correlated.
- Test regularly with exercises and penetration tests.
Layered security and zero trust
Zero trust does not replace defense in depth; it strengthens it. Instead of trusting anything inside the perimeter, every request is verified at every layer. Read our introduction to zero trust for more.
For specific layers, see stateful vs stateless firewalls, endpoint security and the types of security controls.
Frequently asked questions
What is layered security in cyber security?
It is the practice of using several independent security controls so that a failure in one does not expose the organization. It is also known as defense in depth.
How many layers of cyber security are there?
There is no fixed number. Models commonly describe five to eight layers, such as people, perimeter, network, endpoint, identity, application, data and monitoring.
Is defense in depth still relevant with cloud services?
Yes. The layers change shape, for example identity becomes more important, but the principle of several independent controls still applies.
What is the most important layer?
Identity is now one of the most critical layers because stolen credentials are a common route into organizations. Still, every layer matters because attackers target the weakest one.
Conclusion
Layered cyber security accepts that controls fail and plans for it. Cover every layer with solid basics, segment and monitor your environment, and verify identity at each step. The more layers an attacker must break, the more likely you are to stop them.
