| Defence in Depth combines people, processes and technical controls so a business does not rely on a single safeguard. Different controls prevent attacks, detect suspicious activity, limit damage and support recovery, and the aim is that no one weakness defeats the whole arrangement. Four products reading the same signal at the same point add less than the invoice suggests. |
The scenario that follows is illustrative. A 35-person engineering firm was paying for four security products when it lost a server on a Thursday morning.
The backup job had been running nightly for three years and nobody had ever restored from it. When they tried, the restore failed on a permissions error that had sat in the log since the previous winter, so copies existed and could not be used. The log went to an inbox nobody had opened since the person who set it up left.
Rebuilding took four days of lost billable time and contractor hours.
The firm had been paying for a recovery layer it did not have. That is the defence in depth question underneath everything below: not how much you spend, but how many separate things have to fail before an attacker reaches your data.
None of that was for want of spending. Its security budget went on an endpoint product, an email filter, a second anti-malware agent bought after a scare, and a web filter that came with the firewall.
Every one of those four was working. The endpoint agent had blocked plenty that quarter and the email filter was quarantining junk daily, so the dashboards all read green.
Mapped against the ten controls New Zealand’s National Cyber Security Centre recommends, those four products clustered on the same part of the path and touched only a few of the ten. Three of the four did much the same job.
Nothing in that list watched for a failed backup, and nothing told anyone that a log had been going to an empty inbox for eight months.
What the threats look like, and how each one works, belongs to our guide to malware protection and the posts around it. This one stays on the shape of defence in depth, the part an owner can check without help.
Two defence in depth questions do most of the work. How many separate layers do you have, and where are the gaps between them.
Why Do Businesses With Good Security Still Get Breached?
Because defence in depth spending tends to buy the same layer more than once. A firm can hold four products, feel well covered, and still leave a single point of failure if all four inspect the same traffic in the same place.
The pattern is easy to fall into. Each product was bought after a scare and solved the problem in front of it, and nobody stood back to ask which part of the route into the business it guarded. The number that matters is how many separate failures stand between an attacker and your data.
Name the last incident you heard of in your industry, then ask which of your controls would have been the second one to try. Owners name the first without hesitating and then stop.
There is a fair argument on the other side. Buying several controls from one vendor makes them easier to manage, and a suite that shares signals between its parts does catch things a scattered set of tools would miss.
The cost of that convenience is correlated failure. When one supplier has a bad day, or one licence lapses at renewal, several of your layers have it together. Make that trade with your eyes open, and refuse it on the layers that carry the business.
What makes a security layer real?
Different failure modes. The NIST definition of defence in depth calls it a strategy that puts people, technology and operations together to build variable barriers across several layers of an organisation, and a related NIST publication describes layering heterogeneous technologies so that an attack slipping past one is caught by another.
Neither requires a control to be wholly independent, and neither mentions vendors. Independence is a design question rather than a pass or fail test.
The useful version asks what additional protection a control gives you, and what could take several out at once. A shared administrator account, a shared identity service, one management console, a power supply or a single configuration error can all reach across products from different suppliers. Different names on the invoices do not make controls independent.
Two anti-malware agents overlap heavily, because both are looking for something malicious at roughly the same point, though modern products watch behaviour as well as matching files they have seen before. An anti-malware agent and a rule stopping staff running unapproved software overlap far less, because the second holds even when the first has never seen the file.
In a defence in depth arrangement, overlap earns its keep when one control catches what another misses. It becomes waste when a second product adds little, or brings conflict and complexity with it. Before retiring anything, check what it actually has enabled, what depends on it, and what protection would remain without it.
Is defence in depth the same as layered security?
In practical guidance the two are used interchangeably and little turns on the difference. Where a distinction is drawn, layered security describes the arrangement of controls stacked one behind another, while defence in depth is the wider strategy that puts technology alongside people and process.
The part worth keeping from the military origin is the assumption. Successive positions were meant to slow an advance enough to respond to it, and nobody expected the first line to hold. That assumption is the one most businesses skip.
Which Security Layers Should a New Zealand Business Have?
There is no fixed number of defence in depth layers, and the most useful New Zealand answer is the NCSC Critical Controls. The National Cyber Security Centre publishes ten, reviewed each year against the incidents it actually sees, and says that correctly implemented they would prevent, detect or contain most attacks experienced by New Zealanders.
The ten are worth reading as layers, one line at a time:
- Patch your software and systems
- Implement multi-factor authentication and verification
- Provide and use a password manager
- Centralised logging
- Build security awareness in your organisation
- Asset lifecycle management
- Implement and test backups
- Implement application control
- Enforce the principle of least privilege
- Implement network segmentation and separation
Few of them are products. Least privilege, segmentation and asset lifecycle management are decisions about how the business is arranged, and what they cost is mostly time.
Ten controls are not ten independent layers, and covering eight of them says nothing about how well any one is implemented. Each has a scope and a standard to meet, and several depend on others: logging is worth little without somebody acting on it, and least privilege depends on knowing what people actually need.
A defence in depth list also holds prevention, detection, containment and recovery together. An arrangement built only from things that block has no answer for the day something gets through.
That is also why they get skipped. A renewal turns up in the diary on its own, and tidying up administrator rights waits for somebody to put it there. Give those defence in depth layers a review date on the same cycle as the renewals.
What are the five layers of defence in depth?
Vendor guides commonly group the controls into five: perimeter, network, endpoint, application and data. Different models group them differently, so the count changes from one guide to the next.
It is useful for a first sort, separating controls that stop somebody arriving from controls that protect what they came for. It stops being useful the moment anyone treats it as a defence in depth checklist.
Three principles hold under any version of defence in depth. Controls must fail for different reasons, they have to cover the whole route and not one end, and the design must assume some will give way.
Which layers do most small businesses already have?
Four defence in depth layers, as a rule: patching, some anti-malware, an email filter, and multi-factor authentication on email. Those four are the ones sold as products, so they are the ones that get bought.
That is a reasonable start, heavily weighted to one end of the path. All four try to stop a stranger getting in.
The weighting is not an accident. Blocking things comes in a box with a price on it, while taking administrator rights off nine people means nine awkward conversations.
Which layers are usually missing?
Centralised logging, least privilege and network segmentation, in our experience. Least privilege in particular is a decision rather than a purchase, so nobody is chasing you to buy it, and the other two need design work before anything is switched on, which is enough to keep them waiting.
Least privilege means nobody carries administrator rights they do not need that day, and the NCSC guidance on it sets out the practical version: separate accounts for ordinary work and administrative work, so a stolen everyday credential cannot be used to change how a system is configured. It can still be used for whatever that account is legitimately allowed to do, which is why least privilege limits the damage rather than removing it.
Segmentation means restricting traffic to the connections you have authorised, so the workshop machine cannot reach the finance server. Separate networks only deliver that when the rules between them are enforced; their existence alone is not isolation.
Centralised logging brings selected records together so they can be analysed. Turning records into a warning takes three more things: the right events collected, alert rules configured, and notification reaching somebody who will act. In the scenario above it was the last of those that was missing, and a backup monitoring tool could have escalated that fault without any central platform at all.
Those three decide how far an attacker travels once the first four have failed, and they are the difference between one compromised laptop and a weekend rebuilding a network.
They also affect how quickly you find out. Without collected records and somebody reviewing them, a business is more likely to hear about an intrusion from a customer, an insurer or a bank, which is later and more expensive than finding it yourself. Logging supports detection and investigation; it does not stop a transfer on its own.
Pick one and close it this quarter, choosing by exposure rather than by cost. If patching, authentication or recovery is the weak point, start there. Least privilege is often the cheapest of the three, because the work is a list of who holds administrator rights and a conversation about who still needs them.
How Do You Tell a Real Layer From a Duplicate One?
Draw the path an attacker has to walk, then write each control on the step it guards. Duplicates land on top of each other, and gaps show up as steps with nothing on them.
One common path runs through reaching a person, getting a credential, running something, moving sideways, reaching the data and taking it out. Treat it as an example rather than the route. An exposed server can be attacked with nobody receiving a message, invoice fraud can cost real money without any malware, and a compromised cloud account can bypass the office network entirely.
Add response and recovery to the end of whatever path you draw, and let a control appear against more than one step. Backup guards none of the six steps above and is still among the most important things you own, which is a fault in the diagram rather than in the backup.
Write the steps across a whiteboard and put every product you pay for underneath the one it guards. Twenty minutes of that gives a more honest picture of your defence in depth than a dashboard will.
| Step on the path | A control that guards it | What it costs when this is the only one |
|---|---|---|
| Reaching a person | Email filtering and staff who report what looks wrong | One convincing message reaches somebody having a bad day |
| Getting a credential | Multi-factor authentication and a password manager | A reused password from an unrelated breach opens the door |
| Running something | Application control and anti-malware | Something the scanner does not recognise runs anyway |
| Moving sideways | Network segmentation and least privilege | One workshop PC reaches the finance server |
| Reaching the data | Access permissions reviewed against who still needs them | A leaver’s account still opens the client folder |
| Taking it out | Centralised logging and alerting | Nobody is likely to find out until a customer tells you |
Firms come out of this exercise looking much the same, with three or four controls piled on the opening steps of the path and the closing ones blank. That shape, rather than the number of products, is what a defence in depth review is looking for.
Where Are the Gaps Between the Layers?
Often in the joins. Most defence in depth failures are not a control that stopped working, but a handover nobody owned. Individual controls are frequently configured correctly and the trouble appears where one passes to the next. These are four gaps worth checking by name.
The exception nobody removed. A rule was relaxed for one project in 2023, the project finished, and the rule stayed. Firewall rule sets and permission groups both collect these, and neither raises an alarm.
Then there is the system nobody put in the asset register. A device or a subscription bought by a department, so it is never patched, never logged and never covered by any of the ten controls.
This is why asset lifecycle management appears on the NCSC list. An unrecorded device may still pick up some protection from network or cloud controls, but nobody can say which, and that uncertainty is the risk.
The alert with no owner. A control that detects correctly and reports into a mailbox, a dashboard or a person who has left. The failed backup in the opening was exactly this, and it had been reporting the fault accurately for eight months.
Give every alert a named person and a reserve. An alert routed to a role nobody fills is the most expensive kind, because the control looks healthy in every report.
Last, and most common, is the layer nobody has tested. A backup that has not been restored, a failover that has not been failed over, a report line nobody has ever used.
Run it once and you find out which of those you own on a day you picked, at a cost you set.
What the four have in common is that the control still reports itself as working, so the gap is unlikely to appear in a dashboard or a renewal quote.
They surface when somebody walks the path on purpose and asks what happens at each handover, so put an hour in the diary once a quarter.
How Do You Test That Your Security Layers Work?
By testing the outcome each control is meant to deliver, on a date in the calendar, and writing down what happened. Testing is the defence in depth step almost every business skips, because nothing breaks while you skip it.
Scope the work before anybody touches anything, because testing defence in depth badly can cause the outage it was meant to prevent. Your IT team or provider agrees what will be tested and how, runs the technical checks safely, and confirms the result. An owner sponsors the work and reads the outcome. None of what follows is permission to disable a live control, reach into restricted business data, or restore over a production system.
Restore into an isolated environment
Restore a single file and a full system into a test environment rather than over the live one, and time both. NCSC recommends a single-file restore at least quarterly and a full restoration at least once a year, across different scenarios: a deleted file, a failed application upgrade, a database rollback, an operating system restore.
Check access against what the role should have
Using an approved test account, compare the access it actually has with the access that role is supposed to have. Reaching a file server is not a failure in itself; reaching one the role has no business in is.
Send a safe test event and follow the alert
Generate a test alert and watch what happens to it: who receives it, how long it takes, what they do next, and who covers them when they are away.
Each answers a defence in depth question a written policy cannot. A restore either completes or it does not, and the time it takes is the number to write down.
Record the result where the next person will find it, with the date and who ran it. A restore proven eighteen months ago says very little about the server as it stands today.
Somebody has to own that calendar or none of it happens. With no internal IT person that is whoever signs the invoices, because nobody else notices a skipped test.
The people layer of a defence in depth setup is tested the same way, with more care, since the point is to measure the process and never to catch anybody out. Our guide to security awareness training covers how to run that so people keep reporting.
A penetration test or a security audit answers a different question again. When to commission one depends on your exposure, what you need to prove and to whom, rather than on finishing a checklist first. Testing your own layers beforehand does tend to make the engagement cheaper, because you stop paying a specialist to find the backup nobody had restored.
What Does Defence in Depth Cost a Small Business?
What defence in depth costs depends on what you already hold, and for most businesses the recurring cost moves less than the coverage does. What drives it: how many users, devices and sites are in scope, what the existing licences already cover, how much configuration work the gaps need, how much monitoring coverage you want, and who manages it afterwards.
For the illustrative firm, retiring two overlapping products released budget, and most of that went straight back out again on centralised logging alerting to a named person, a password manager, and the time to set up segmentation and review administrator rights. The recurring total came down slightly rather than dramatically, which is the point: it was a reallocation, not a saving.
What changed was not a score. Coverage is not a count of controls held, and holding a licence is not the same as implementing a control to a standard. The firm went from products clustered on the opening steps to controls spread across the path, including detection and recovery it did not have at all.
The one-off side is a separate number and should stay separate. Building and testing a recovery layer, with a documented restore and a first rehearsal, is project work, and in the first year it sits on top of the recurring spend rather than inside it.
The tooling that remains still matters to your defence in depth. A managed firewall that somebody reviews is a different control from one installed five years ago and left alone, and the reviewing is most of the value.
What does this look like for a ten-person business?
Smaller, and no different in kind. Defence in depth at that size leans on controls that are mostly configuration and habit: multi-factor authentication, a password manager, patching, least privilege and tested backups.
Where to start is a question about exposure rather than a target number. If patching, authentication or recovery is the weak point, that comes first, whatever it does to a count.
Where Should a Business Start With Defence in Depth?
Start your defence in depth by mapping the controls already in place, because most firms find duplication and gaps in the same hour. Then identify the gaps, check what those controls share, and prioritise the changes that would reduce the most significant risks.
List what you pay for and what it guards
Every security control on the invoices, with the step of the path it guards written beside it. Include the controls that are decisions rather than purchases, because they are the ones that get forgotten.
Mark the steps with nothing against them
Those are your gaps, and in most defence in depth reviews they cluster at the end of the path, around detection, containment and recovery.
Read the ten NCSC Critical Controls against your list
As layers rather than products, and noting which are genuinely implemented rather than merely owned. Resist turning it into a score, because eight controls held to a poor standard is not better than five done properly.
Check duplicates properly before retiring anything
A whiteboard identifies candidates. A technical review establishes what each product actually has enabled, what depends on it and what protection would remain, and that has to happen before a licence is cancelled.
Put a test date against every layer
Treat an untested layer as unverified rather than proven, which is a reason to test it rather than to replace it. Prioritise the ones carrying the business.
None of that needs a new platform. It is an afternoon with a whiteboard and the invoices, followed by a technical review before anything is switched off.
The order matters more than the speed. Mapping your defence in depth before buying stops a business adding a fifth product to a layer that already holds four, and covering the opening steps twice while the second half of the path stays empty.
How Many of Your Layers Have Ever Been Tested?
Exodesk has operated since 1989, with offices in Christchurch and Dunedin serving businesses across New Zealand. Our cyber security team maps your defence in depth against the ten controls, names the steps with nothing guarding them, and tests the layers nobody has had reason to trust.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What is Defence in Depth in cyber security?
Defence in depth combines people, processes and technical controls along the route an attacker has to travel, so the business does not rely on a single safeguard. Different controls prevent, detect, contain and support recovery. It is a way of checking coverage rather than something you buy as a product, and what sets it apart from simply owning a lot of security software is the assumption built into it, that some controls will fail.
What are the ten NCSC Critical Controls?
There is no fixed number of layers, and for a New Zealand business the most useful list is the ten Critical Controls published by the National Cyber Security Centre. They cover patching, multi-factor authentication, password managers, centralised logging, security awareness, asset lifecycle management, tested backups, application control, least privilege, and network segmentation. Reading them as layers, and not as products, shows which parts of the path are already guarded.
What is centralised logging and why does it matter?
Centralised logging brings selected activity records together so they can be analysed in one place. Collecting them is only the first part: the right events have to be captured, alert rules configured, and notifications sent to somebody who will act on them. It is one of the ten NCSC Critical Controls and one of the layers small businesses skip, and without it a business is more likely to hear about a problem from a customer, an insurer or a bank.
How many defence in depth layers does a small business need?
Enough that no single failure reaches your data, which means covering every step an attacker has to walk before worrying about a target number. Counting products is the wrong measure, because several often guard the same step, and counting controls held is not much better, because holding a licence is not the same as implementing a control properly.
What is an example of layered security in practice?
A staff member receives a convincing invoice request. The email filter does not catch it, the person reports it because they were trained to, the payment is held because the business verifies changed bank details on a known phone number, and logging shows what else was attempted. Several separate things had to work and the first one failed. Note that multi-factor authentication is not the control doing the work here: a legitimate account can send a fraudulent request, and some phishing can relay a code in real time, which is why phishing-resistant methods matter where the risk is credential theft rather than payment fraud.
Can a business have too much security software?
Yes, in the sense that four products guarding one step return less than four products guarding four steps. Buying more of the same layer adds cost without adding depth, and overlapping agents can slow machines down or interfere with each other. Count the separate failures an attacker would have to cause, and not the licences you hold.
What is the principle of least privilege?
Least privilege means each person holds only the access their job needs, and no more. In practice an administrator keeps two logins, one for daily work and one for changes, so a credential stolen from the first cannot be used to reconfigure systems. It can still do whatever that account is legitimately allowed to do, so least privilege limits the damage rather than removing it. It appears on the NCSC Critical Controls list and is among the cheaper layers to add, since most of the work is a review rather than a purchase.
Does network segmentation matter for a small business?
Yes, and it is one of the most commonly skipped layers. Segmentation restricts communication to the connections you have authorised, so a compromised machine in one part cannot reach systems in another. Separate networks only achieve that when the rules between them are enforced, since their existence alone is not isolation. For a small business the practical version is keeping guest devices, workshop or plant equipment, and the finance systems off the same flat network.
How often should defence in depth layers be tested?
For backups, NCSC recommends restoring a single file at least quarterly and a full restoration at least once a year, across different scenarios such as a deleted file, a failed application upgrade, a database rollback or an operating system restore. Other controls should be tested on a frequency that reflects how critical they are, what has changed and what you need to be able to recover, rather than on a fixed annual rule. Treat a layer that has never been tested as unverified rather than proven.
What does layered security cost a small business?
It depends on what you already hold. The exercise often turns up duplicate products covering the same layer, and retiring genuine duplicates can fund the missing ones, which makes it a reallocation more often than a saving. What drives the cost is users, devices and sites in scope, what existing licences already cover, the configuration work the gaps need, how much monitoring you want and who manages it afterwards. Do not assume the review will reduce spending.
What is the first thing to fix in a layered security setup?
Draw the path an attacker has to walk and write each control you pay for beside the step it guards. The steps with nothing written against them are your gaps, and they tend to cluster at the end of the path. The mapping itself takes an afternoon with your subscription list; confirming whether a product is genuinely a duplicate needs a technical review before anything is cancelled.
Does Exodesk build defence in depth for New Zealand businesses?
Yes. Exodesk has operated since 1989, with offices in Christchurch and Dunedin serving businesses across New Zealand. That work covers mapping existing controls against the NCSC Critical Controls, closing the gaps that get deferred because nobody is selling them, and testing the layers that have never been exercised.
NEXT STEP
Which of your layers would stop the second attempt?
Most businesses can name the control that stops the first one and go quiet after that. An IT assessment maps every control you pay for onto the step it guards, shows which steps have nothing written against them, and checks whether the layers you are counting on have ever been tested.
Or read more about our cyber security services.
