| Defence in Depth is a security strategy that puts several independent controls between an attacker and your data, so a failure in one is caught by the next. The word doing the work is independent, because four products that all read the same signal are one layer bought four times. |
A 35-person engineering firm in Christchurch was paying for four security products when it lost a server on a Thursday morning.
The backup had been running nightly for three years. Nobody had restored from it.
When they tried, the job failed on a permissions error that had been in the log since the previous winter. The log went to an inbox nobody had opened since the person who set it up left.
Rebuilding took four days and about $11,200 in lost billable time and contractor hours.
The firm had been paying for a recovery layer it did not have.
None of that was for want of spending. The figures below are illustrative, and the firm was paying $1,150 a month for security tooling, or $13,800 a year. It went on an endpoint product, an email filter, a second anti-malware agent bought after a scare, and a web filter that came with the firewall.
Every one of those four was working. The endpoint agent had blocked plenty that quarter and the email filter was quarantining junk daily, so the dashboards all read green.
Mapped against the ten controls New Zealand’s National Cyber Security Centre recommends, those four products covered four of them. Three of the four sat on the same layer.
Nothing in that list watched for a failed backup, and nothing told anyone that a log had been going to an empty inbox for eight months.
What the threats look like, and how each one works, belongs to our guide to malware protection and the posts around it. This one stays on the shape of the defence, the part an owner can check without help.
Two questions do most of the work. How many independent layers do you have, and where are the gaps between them.
Why Do Businesses With Good Security Still Get Breached?
Because security spending tends to buy the same layer more than once. A firm can hold four products, feel well covered, and still leave a single point of failure if all four inspect the same traffic in the same place.
The pattern is easy to fall into. Each product was bought after a scare and solved the problem in front of it, and nobody stood back to ask which part of the route into the business it guarded. The number that matters is how many separate failures stand between an attacker and your data.
Name the last incident you heard of in your industry, then ask which of your controls would have been the second one to try. Owners name the first without hesitating and then stop.
There is a fair argument on the other side. Buying several controls from one vendor makes them easier to manage, and a suite that shares signals between its parts does catch things a scattered set of tools would miss.
The cost of that convenience is correlated failure. When one supplier has a bad day, or one licence lapses at renewal, several of your layers have it together. Make that trade with your eyes open, and refuse it on the layers that carry the business.
What makes a security layer real?
Independence. The NIST definition of defence in depth calls it a strategy that puts people, technology and operations together to build variable barriers across several layers of an organisation.
The engineering standard it cites is blunter. The method works by layering heterogeneous technologies, so that an attack slipping past one is caught by a different one.
Heterogeneous does the work in that sentence. Two controls form a layer only when they fail for different reasons.
Two anti-malware agents from different vendors are closer to one layer than two, because both look for a bad file at the same moment in the same place. An anti-malware agent and a rule stopping staff running unapproved software are two, because the second holds even when the first has never seen the file.
Ask one question of every control you pay for. If the control beside it fails, does this one still work, and for a different reason.
Is defence in depth the same as layered security?
Close, and the difference is worth knowing. Layered security describes the arrangement, meaning controls stacked one behind another, and the term predates computing by a long way.
It comes from military engineering, where successive positions were meant to slow an advance enough to respond to it. Nobody expected the first line to hold.
Defence in Depth carries that assumption across. It is the wider strategy that layers technology alongside people and process, and it takes for granted that some layers will fail. That last part is the one most businesses skip.
Which Security Layers Should a New Zealand Business Have?
There is no fixed number, and the most useful New Zealand answer is the NCSC Critical Controls. The National Cyber Security Centre publishes ten, reviewed each year against the incidents it actually sees, and says that correctly implemented they would prevent, detect or contain most attacks experienced by New Zealanders.
The ten are worth reading as layers, one line at a time:
- Patch your software and systems
- Implement multi-factor authentication and verification
- Provide and use a password manager
- Centralised logging
- Build security awareness in your organisation
- Asset lifecycle management
- Implement and test backups
- Implement application control
- Enforce the principle of least privilege
- Implement network segmentation and separation
Few of them are products. Least privilege, segmentation and asset lifecycle management are decisions about how the business is arranged, and what they cost is time.
The list also holds prevention, detection and containment together. A defence built only from things that block has no answer for the day something gets through.
That is also why they get skipped. A renewal turns up in the diary on its own, and tidying up administrator rights waits for somebody to put it there. Give those layers a review date on the same cycle as the renewals.
What are the five layers of defence in depth?
Vendor guides commonly group the controls into five: perimeter, network, endpoint, application and data. No standards body publishes that grouping, so the count changes from one guide to the next.
It is useful for a first sort, separating controls that stop somebody arriving from controls that protect what they came for. It stops being useful the moment anyone treats it as a checklist.
Three principles hold under any version of the list. Controls must fail for different reasons, they have to cover the whole route and not one end, and the design must assume some will give way.
Which layers do most small businesses already have?
Four, as a rule: patching, some anti-malware, an email filter, and multi-factor authentication on email. Those four are the ones sold as products, so they are the ones that get bought.
That is a reasonable start, heavily weighted to one end of the path. All four try to stop a stranger getting in.
The weighting is not an accident. Blocking things comes in a box with a price on it, while taking administrator rights off nine people means nine awkward conversations.
Which layers are usually missing?
Centralised logging, least privilege and network segmentation, in our experience. Nobody sells them, so nobody is chasing you to buy them.
Least privilege means nobody carries administrator rights they do not need that day, and the NCSC guidance on it sets out the practical version: separate accounts for ordinary work and administrative work, so a stolen everyday credential cannot change how a system is configured.
Segmentation means the workshop machine cannot reach the finance server. Centralised logging means the failed backup above would have raised an alert somebody was watching for.
Those three decide how far an attacker travels once the first four have failed, and they are the difference between one compromised laptop and a weekend rebuilding a network.
They also decide how quickly you find out. A business with no central log learns about an intrusion from a customer, an insurer or a bank. That is always later and always more expensive.
Pick one and close it this quarter. Least privilege is usually cheapest, because the work is a list of who holds administrator rights and a conversation about who still needs them.
How Do You Tell a Real Layer From a Duplicate One?
Draw the path an attacker has to walk, then write each control on the step it guards. Duplicates land on top of each other and gaps show up as steps with nothing on them.
The path in a small business runs through reaching a person, getting a credential, running something, moving sideways, reaching the data and taking it out. A control that guards none of those is not a layer.
Write the steps across a whiteboard and put every product you pay for underneath the one it guards. It takes twenty minutes and gives a more honest picture than any dashboard.
| Step on the path | A control that guards it | What it costs when this is the only one |
|---|---|---|
| Reaching a person | Email filtering and staff who report what looks wrong | One convincing message reaches somebody having a bad day |
| Getting a credential | Multi-factor authentication and a password manager | A reused password from an unrelated breach opens the door |
| Running something | Application control and anti-malware | Anything the scanner has not seen before executes |
| Moving sideways | Network segmentation and least privilege | One workshop PC reaches the finance server |
| Reaching the data | Access permissions reviewed against who still needs them | A leaver’s account still opens the client folder |
| Taking it out | Centralised logging and alerting | Nobody finds out until a customer tells you |
Firms come out of this looking much the same, with three or four controls piled on the opening steps and the closing ones blank.
Where Are the Gaps Between the Layers?
In the joins. The layers themselves are generally configured properly, and the failures happen where one hands over to the next. These are the four worth checking by name.
The exception nobody removed. A rule was relaxed for one project in 2023, the project finished, and the rule stayed. Firewall rule sets and permission groups both collect these, and neither raises an alarm.
Then there is the system nobody put in the asset register. A device or a subscription bought by a department, so it is never patched, never logged and never covered by any of the ten controls.
This is why asset lifecycle management appears on the NCSC list. A control can only cover a machine somebody wrote down, so the unrecorded one sits outside all ten.
The alert with no owner. A control that detects correctly and reports into a mailbox, a dashboard or a person who has left. The failed backup in the opening was exactly this, and it had been reporting the fault accurately for eight months.
Give every alert a named person and a reserve. An alert routed to a role nobody fills is the most expensive kind, because the control looks healthy in every report.
Last, and most common, is the layer nobody has tested. A backup that has not been restored, a failover that has not been failed over, a report line nobody has ever used.
Run it once and you find out which of those you own on a day you picked, at a cost you set.
What the four have in common is that each control still reports itself as working, so none of them shows up on a dashboard or in a renewal quote.
They surface when somebody walks the path on purpose and asks what happens at each handover, so put an hour in the diary once a quarter.
How Do You Test That Your Security Layers Work?
By making each one fail on purpose, on a date in the calendar, and writing down what happened. Testing is the step almost every business skips, because nothing breaks while you skip it.
Start with the cheapest three, because none needs an outside party.
- Restore one real file and one whole server from backup, and time both.
- Take an ordinary staff account and try to reach the finance system, the file server and the admin console with it.
- Trigger one alert deliberately and see who receives it, how long it takes, and what they do next.
Each answers a question a written policy cannot. A restore either completes or it does not, and the time it takes is the number to write down.
Record the result where the next person will find it, with the date and who ran it. A restore proven eighteen months ago says very little about the server as it stands today.
Somebody has to own that calendar or none of it happens. With no internal IT person that is whoever signs the invoices, because nobody else notices a skipped test.
The people layer is tested the same way, with more care, since the point is to measure the process and never to catch anybody out. Our guide to security awareness training covers how to run that so people keep reporting.
A penetration test or a security audit belongs above all of this, once the basics hold. Testing your own layers first makes that engagement cheaper, because you stop paying a specialist to find the backup nobody had restored.
What Does Defence in Depth Cost a Small Business?
For the illustrative 35-person firm above, about $13,200 a year, set against the $13,800 a year it was already spending. The net is about $600 a year less, and the return here is coverage.
Two of the four overlapping products were retired, releasing about $4,200 a year. That money bought centralised logging alerting to a named person, a password manager for the firm, and the time to set up segmentation and review administrator rights.
Coverage moved from four of the ten controls to eight, and cost moved by less than the price of one product.
That ratio is common enough to expect, because duplication is expensive and the gaps are cheap to close.
The one-off side is a separate number and should stay separate. Building and testing the recovery layer, with a documented restore and a first rehearsal, ran about $2,900 against the $11,200 that untested backup cost on one Thursday.
The tooling that remains still matters. A managed firewall that somebody reviews is a different control from one installed five years ago and left alone, and the reviewing is most of the value.
What does this look like for a ten-person business?
Smaller, and no different in kind. A ten-person firm can reach seven or eight of the ten controls without buying much at all.
Multi-factor authentication, a password manager, patching, least privilege and tested backups are mostly configuration and habit. The two that need spending are centralised logging and application control.
Where Should a Business Start With Defence in Depth?
Start by drawing what you already have, because most firms find duplication and gaps in the same hour. Then work through five steps in order:
- List every security control you pay for, and write beside each one which step of the path it guards.
- Mark the steps with nothing written against them. Those are your gaps.
- Check the ten NCSC Critical Controls against your list and count how many you cover.
- Retire genuine duplicates and move the money to a missing layer, starting with logging and least privilege.
- Put a test date in the calendar for every layer, and treat an untested layer as one you do not have.
None of that needs a new platform. It is an afternoon with a whiteboard and the invoices.
The order matters more than the speed. Mapping before buying stops a business adding a fifth product to a layer that holds four. That is how the firm above reached $13,800 a year without covering the second half of the path.
The engineering firm at the top of this post did the exercise a fortnight after the server came back. It had been paying for a recovery layer since 2023.
How Many of Your Layers Have Ever Been Tested?
Exodesk has supported South Island businesses since 1989 and works with clients across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. Our cyber security team maps what you pay for against the ten controls, names the steps with nothing guarding them, and tests the layers nobody has had reason to trust.
Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.
Frequently Asked Questions
What is Defence in Depth in cyber security?
The term describes an approach where several separate controls stand along the route an attacker has to travel, each one able to hold if the ones around it give way. New Zealand businesses meet it as a way of checking coverage, and it is not something you buy as a product. What sets the approach apart from simply owning a lot of security software is the assumption built into it, that some controls will fail.
What are the ten NCSC Critical Controls?
There is no fixed number of layers, and for a New Zealand business the most useful list is the ten Critical Controls published by the National Cyber Security Centre. They cover patching, multi-factor authentication, password managers, centralised logging, security awareness, asset lifecycle management, tested backups, application control, least privilege, and network segmentation. Reading them as layers, and not as products, shows which parts of the path are already guarded.
What is centralised logging and why does it matter?
Centralised logging collects the activity records from every system into one place, so that a fault or an intrusion shows up in a single view. It is one of the ten NCSC Critical Controls and one of the layers small businesses skip. Without it, a business learns about a problem from a customer, an insurer or a bank, and always later than it needed to.
How many security layers does a small business need?
Enough that no single failure reaches your data, which for most small businesses means covering every step an attacker has to walk before you worry about a target number. A ten-person firm can reasonably reach seven or eight of the ten NCSC Critical Controls. Counting products is the wrong measure, because several products often guard the same step.
What is an example of layered security in practice?
A staff member receives a convincing invoice. The email filter does not catch it, the person reports it because they were trained to, multi-factor authentication blocks the credential that was harvested anyway, and centralised logging shows the attempt so somebody can check what else was tried. Four separate things had to work, and the first one failed.
Can a business have too much security software?
Yes, in the sense that four products guarding one step return less than four products guarding four steps. Buying more of the same layer adds cost without adding depth, and overlapping agents can slow machines down or interfere with each other. Count the separate failures an attacker would have to cause, and not the licences you hold.
What is the principle of least privilege?
Least privilege means each person holds only the access their job needs, and no more. In practice an administrator keeps two logins, one for daily work and one for changes, so a credential stolen from the first cannot reconfigure anything. It appears on the NCSC Critical Controls list and is among the cheapest layers to add, since the work is a review and no money changes hands.
Does network segmentation matter for a small business?
Yes, and it is one of the most commonly skipped layers. Segmentation means dividing the network so that a compromised machine in one part cannot reach the systems in another. For a small business the practical version is keeping guest devices, workshop or plant equipment, and the finance systems off the same flat network.
How often should security layers be tested?
Backups need a restore test at least quarterly, and every other layer needs testing at least once a year or after any significant change. A layer that has never been tested should be treated as one you do not have.
What does layered security cost a small business?
Often less than a business already spends, because the exercise turns up duplicate products covering the same layer. For an illustrative 35-person firm, retiring two overlapping products released about $4,200 a year, which funded logging, a password manager and the work to set up segmentation and least privilege.
What is the first thing to fix in a layered security setup?
Draw the path an attacker has to walk and write each control you pay for beside the step it guards. The steps with nothing written against them are your gaps, and they cluster at the end of the path. It takes an afternoon, and what it needs is your subscription list, not a consultant.
Does Exodesk help New Zealand businesses build layered security?
Yes. Exodesk works with businesses across Canterbury, Otago and Southland from offices in Christchurch and Dunedin, and has supported South Island clients since 1989. That work covers mapping existing controls against the NCSC Critical Controls, closing the gaps nobody is selling you, and testing the layers that have never been exercised.
NEXT STEP
Which of your layers would stop the second attempt?
Most businesses can name the control that stops the first one and go quiet after that. An IT assessment maps every control you pay for onto the step it guards, shows which steps have nothing written against them, and checks whether the layers you are counting on have ever been tested.
Or read more about our cyber security services.
