Topic 2 of 6
Defense in depth and the CIA triad
Instead of relying on a single barrier, defense in depth combines several layers of controls. If one fails, the next one keeps protecting the data. The layers serve three goals: confidentiality, integrity, and availability.
Contents
What is defense in depth?
It's a layered security strategy, instead of a single perimeter. Each layer protects on its own, so if an attacker gets past one, they still have to get past the rest before reaching the data.
Microsoft compares it to a bank vault: a locked outer door, cameras, motion sensors, a keypad, the vault door, and secured boxes inside. Getting through the first door doesn't give access to the money; the thief still faces several more barriers, and each one raises the chance of being caught.
IT works the same way: no single control is the whole defense. The question isn't "which control do I add?" but "what happens if this control fails?". The answer should always be: another control keeps protecting.
The 7 layers
From the outside in. The data layer sits at the center because it's what every other layer protects.
Physical security
Limits physical access to infrastructure: locked facilities, guards, badge readers, and cameras. Prevents anyone from tampering with or stealing servers, network equipment, or storage.
Example: Only authorized staff enter the datacenter.
Identity and access
Authenticates and authorizes before granting access: MFA, RBAC, and Conditional Access policies that evaluate signals like location, device compliance, and risk level.
Example: Even if an attacker has a valid password, MFA stops them.
Perimeter
Protects the network edge from large-scale external attacks: DDoS protection, which filters attack traffic before it affects users, and perimeter firewalls that inspect what comes in and goes out.
Example: Azure DDoS Protection filters attack traffic.
Network
Controls communication between resources inside the network: segmentation into isolated zones and network security groups (NSGs) that restrict traffic with rules. It reduces the damage after a single resource is compromised.
Example: A compromised VM can't reach the database subnet.
Compute
Protects VMs, containers, and other compute resources: patched systems and software, unnecessary ports closed, restricted admin access, and monitoring for unusual behavior.
Example: Closing RDP and SSH to the internet.
Application
Applications free of exploitable vulnerabilities: secure development, input validation against SQL injection and XSS, and in-app authentication and authorization. Testing before production is far cheaper than fixing afterward.
Example: Security testing in the deployment pipeline.
Data
The innermost and most critical layer: access controls that limit who reads or modifies data, encryption that makes it unreadable without the keys, and classification that identifies which data needs the strongest protection.
Example: Encrypting sensitive data and labeling it.
Perimeter and network aren't the same
The perimeter protects the edge from external attacks (DDoS, perimeter firewall). The network controls communication between internal resources (segmentation, NSGs). The exam describes controls from one and asks about the other.
An attacker's journey
A useful way to understand the layers is to follow an attacker who wants to steal customer data and see where each layer stops them:
Identity and access: They get a password through phishing, but sign-in requires MFA and Conditional Access flags an unusual location.
Perimeter: They try to overwhelm the service to distract the team; DDoS protection filters the traffic.
Network: They manage to compromise a web server, but segmentation and NSGs keep them from reaching the database subnet.
Compute: They look for open management ports; they're closed and the system is patched.
Application: They try SQL injection; the application validates its inputs.
Data: Even if they reached the files, they're encrypted and they don't have the keys.
Every step costs the attacker time and gives the security team one more chance to detect and respond.
Why layers work
They buy time
Each layer slows the attacker and gives more chances to detect and respond before damage is done.
No control is perfect
A strong control can fail because of a vulnerability, a misconfiguration, or a business process that requires an exception.
They assume breach
The design assumes the attacker will get past the outer defenses and limits what they can do once inside. Perimeters are tested constantly.
"Assume breach" is also one of the Zero Trust principles. Defense in depth and Zero Trust complement each other: one organizes controls into layers; the other decides how each access is verified.
The CIA triad
The layers work toward three security goals: confidentiality, integrity, and availability. They represent what security is ultimately meant to protect.
🔒 Confidentiality
Only authorized people see sensitive information: customer records, financial data, passwords, private communications, or intellectual property.
Encryption alone isn't enough: you also need access controls, secure transmission, and policies defining who can see what. A confidentiality breach (a data breach) brings regulatory penalties, legal liability, and loss of trust.
✅ Integrity
Data is accurate, complete, and only changes through authorized processes: what's read later is exactly what was sent or stored.
It's violated by malicious tampering, software bugs that corrupt data, transmission problems, or unauthorized deletion. It's protected with hashing, digital signatures, audit logs, and transaction controls. Comparing a download's hash with the one the publisher provides is an integrity check.
⚡ Availability
Data and systems are accessible to whoever needs them, when they need them. A secure but inaccessible system is useless.
It's threatened by DDoS attacks, ransomware, hardware failures, software bugs, and natural disasters. It's protected with redundant infrastructure, load balancing, automatic failover, backups with tested recovery plans, and DDoS protection.
Balancing the three goals
The three goals can pull in different directions, and security teams look for the right balance based on data sensitivity, breach impact, and business needs.
Encrypting everything
Protects confidentiality, but if the keys are lost the data becomes permanently inaccessible: availability suffers.
Complex authentication
Protects confidentiality and integrity, but adds friction that can affect productivity.
The triad also helps classify attacks: stealing data targets confidentiality, modifying records targets integrity, and taking systems down targets availability.
Controls, layers, and goals
| Control | Layer | Main goal |
|---|---|---|
| MFA and Conditional Access | Identity and access | Confidentiality and integrity |
| DDoS protection | Perimeter | Availability |
| NSGs and segmentation | Network | Confidentiality (limits lateral movement) |
| Patches and closed ports | Compute | All three |
| Input validation | Application | Integrity and confidentiality |
| Encryption | Data | Confidentiality |
| Hashing and digital signatures | Data | Integrity |
| Backups and failover | Compute / data | Availability |
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| An attacker steals the customer database | Confidentiality | Unauthorized people access protected information: it's a data breach. |
| Someone changes the amounts on some invoices | Integrity | The data was modified outside an authorized process. |
| Ransomware encrypts the servers and the company can't operate | Availability | The systems are no longer accessible to legitimate users. |
| Records that should have been kept are deleted | Integrity | Unauthorized deletion is also an integrity violation. |
| A flood of traffic takes the website down | Availability · perimeter layer | It's a DDoS attack; it's mitigated at the perimeter. |
| A compliant device is required to access an app | Identity and access layer | Conditional Access evaluates signals before granting access. |
Common exam traps
❓ A DDoS attack takes a website offline. Which goal of the CIA triad is affected?
Availability. The attacker doesn't steal or modify data; they prevent legitimate users from accessing it.
❓ Which control protects the integrity of a downloaded file?
Comparing its hash with the one the author publishes. If the file changed, the hash changes. Digital signatures also prove integrity.
❓ Does MFA belong to the perimeter layer?
No. MFA is part of the identity and access layer. The perimeter includes DDoS protection and edge firewalls.
❓ Does unauthorized deletion of records affect availability?
Microsoft classifies it as an integrity violation: the data is no longer complete.
❓ Does encrypting data guarantee confidentiality on its own?
No. You also need access controls, secure transmission, and policies on who can see what.
❓ What is the innermost layer of defense in depth?
The data layer. Physical security is the outermost.
❓ Which layer includes input validation against SQL injection?
The application layer. The compute layer covers patches, ports, and admin access on machines.
Did you get this topic?
Test what you just learned
A company splits its virtual network into isolated subnets and applies NSGs so web servers can't communicate directly with the database subnet. Which layer of defense in depth is it strengthening?
Ready to test "Defense in depth and the CIA triad"?
Original questions, each with a full explanation.
Start a mock exam