Network Security in Depth

At GCSE you met a firewall as a guard on the door and antivirus as a patrol inside. That is a fine start, but a real organisation — a bank, a hospital, a school — cannot bet everything on a single guard. Guards get tired, doors get propped open, and clever attackers find the one gap nobody was watching. So the professionals never ask "what is our security?" as if it were one thing. They ask "what are our layers?"

The governing idea of this page is defence in depth: protect a network with several independent controls stacked one behind another, so that when one is breached — and you must assume one will be — the attacker still faces the next, and the next. No single control is trusted to be perfect, because none is. Security is not a wall; it is an onion.

We will walk that onion from the outside in — firewalls and segmentation at the boundary, encryption on the wire, authentication and access control at every door inside, intrusion detection watching the corridors, secure Wi‑Fi at the edges, and monitoring and logging tying it all together — and then face the layer no technology can protect: the people.

The onion: layers around what matters

Picture the thing you actually care about — the customer database, the patient records, the exam papers — sitting right at the centre. Every layer you add is one more thing an attacker must defeat in turn to reach it. Step through the rings from the outside in:

The power of this arrangement is multiplication, not addition. If the firewall stops 99% of attacks and network authentication independently stops 99% of what slips past, then to reach the core an attack must beat both — only 1% of 1% survives. Each honest layer shrinks the surviving threat again. That is why adding a mediocre extra layer is often worth more than perfecting one you already have: it closes a different door.

Layer 1 — Firewalls: from packet filtering to stateful inspection

A firewall filters traffic crossing a boundary against a ruleset. At A‑level you are expected to know that firewalls are not all equally clever — they come in generations.

Packet filtering (stateless). The simplest firewall judges each packet in isolation, looking only at its header: source and destination IP address, the port and protocol. "Allow TCP to port 443, block everything to port 23." It is fast and cheap, but it has no memory: it cannot tell whether a packet arriving from outside is a genuine reply to a request your network made, or an attacker forging one, because it never remembers that a request went out.
Stateful inspection. A stateful firewall keeps a connection table, remembering every conversation your network has opened. When a packet arrives it asks, "does this belong to a connection one of my machines actually started?" A reply to a request you made is expected and allowed; an unsolicited packet claiming to be a reply has no matching entry and is dropped. This closes the hole stateless filtering leaves open, at the cost of holding state in memory.

Higher still sit application-layer firewalls (or proxies) that understand the traffic inside the packets — spotting that "port 443 traffic" is actually a malformed request trying to exploit a web server. The lesson for a layered design: a firewall filters connections, and even a stateful one waves through anything that obeys the rules. It is a strong first ring, never the last.

A stateless (packet-filtering) firewall inspects each packet alone by its header fields (IP, port, protocol) with no memory of prior traffic.
A stateful firewall tracks the state of each connection, so it can allow packets that belong to a conversation the network started and drop unsolicited ones.

Layer 2 — Segmentation and the DMZ

A single flat network is a gift to an attacker: breach one machine and you can reach every other. Segmentation divides the network into zones with firewalls between them, so a compromise in one zone does not automatically spread to the rest. The classic pattern is the DMZ (demilitarised zone) — a buffer network for the servers that must face the public internet (web, mail, DNS), kept firmly separate from the private internal LAN.

Two firewalls sandwich the DMZ. The outer one lets the internet reach the public servers but nothing deeper. The inner one is far stricter: it lets internal users out and permits only tightly controlled traffic from the DMZ inward. Now if an attacker hijacks the public web server — the most exposed machine you own — they land in the DMZ, not on the network with your payroll and patient records. They have breached a layer and still hit another wall. That is defence in depth made concrete.

The name is borrowed from a military buffer zone — a strip of neutral ground between two hostile territories where neither side keeps its main forces. A network DMZ is the same idea: a no‑man's‑land between the wild internet and your trusted interior, holding only the machines that have to be reachable from outside, and never your crown jewels. Anything in the DMZ is treated as semi‑trusted at best, on the assumption it might one day be captured.

Layer 3 — Encryption in transit: TLS/HTTPS and VPNs

Firewalls decide who may talk to whom; they do nothing to protect a conversation that is allowed but overheard. On a shared medium — public Wi‑Fi, a rented data-centre link, the wider internet — data can be intercepted. Encryption makes the intercepted copy useless, and two forms of it matter on a network:

TLS / HTTPS. Transport Layer Security is the protocol behind the padlock and the https:// address. Before any data flows, the browser and server perform a handshake: they authenticate the server with a digital certificate and agree a fresh secret key. Everything after is encrypted, so an eavesdropper sees only ciphertext. TLS protects a single application's traffic — one website, one email session — end to end.
VPN (Virtual Private Network). A VPN encrypts all of a device's traffic and tunnels it to a trusted gateway, so a remote worker on café Wi‑Fi appears to be safely inside the office network. Where TLS wraps one conversation, a VPN wraps the whole link. It is how organisations extend their protected interior across the untrusted internet to staff at home.

Both defend data in transit. Note what they do not do: encryption keeps a message private, but it will happily deliver a private message to an imposter. Knowing the conversation is secret is worthless unless you also know who is on the other end — which is the next layer.

Layer 4 — Authentication and access control inside the network

Getting past the perimeter should not hand an attacker the keys to everything. Inside the network, every request to a resource is challenged. Two distinct ideas do this work (explored in full here):

Authentication — proving who you are. Passwords, and much better, multi-factor authentication (MFA): something you know (a password) plus something you have (a phone code, a hardware token) or something you are (a fingerprint). A stolen password alone is then not enough.
Authorisation and access control — deciding what you may do once you are in. Under the principle of least privilege, each account gets only the access its job needs and no more, often via role-based access control. If a receptionist's account is compromised, the attacker inherits a receptionist's tiny slice of access, not an administrator's.

This is the interior wall of the onion. It assumes the outer rings might already have failed — that the attacker is already inside — and still refuses to trust them without proof and still confines them to a narrow set of permissions. An attacker who is authenticated as nobody important, and authorised to touch almost nothing, has won very little.

Layer 5 — Intrusion detection and prevention (IDS / IPS)

Every layer so far is a barrier. But barriers are silent — they do not tell you an attack is under way. An Intrusion Detection System (IDS) is the burglar alarm: it watches network traffic and system activity for signs of attack and raises an alert. An Intrusion Prevention System (IPS) goes one step further and can act — dropping the malicious traffic or blocking the source automatically. The difference is a single word: an IDS detects and warns; an IPS detects and stops.

Both spot trouble in one of two ways, and A‑level expects the contrast:

Signature-based detection matches traffic against a database of known attack patterns — accurate for threats it has seen, blind to brand-new ones with no signature yet.
Anomaly-based detection first learns what normal traffic looks like, then flags anything that deviates — a workstation suddenly scanning thousands of ports at 3 a.m. This can catch novel attacks, but it also raises false positives when normal behaviour simply changes.

An IDS/IPS is the layer that admits the others might fail and plans for it: rather than assuming the walls hold, it assumes something will get through and makes sure a human — or an automatic response — finds out fast.

Layer 6 — Securing the wireless edge: WPA and MAC filtering

A wired attacker needs physical access to a socket. A wireless network sprays its signal into the car park, so its edge needs its own protections.

WPA2 / WPA3 (Wi‑Fi Protected Access). The current standards encrypt the radio link and require a key or credentials to join. They replaced the ancient WEP, which used a fatally weak cipher that can be cracked in minutes — a live reminder that "we have encryption" means nothing if it is the wrong encryption. WPA3 strengthens the handshake so an attacker cannot capture it and guess the password offline.
MAC address filtering. The access point keeps an allow-list of the hardware MAC addresses permitted to connect. It is a useful extra hurdle — but only a small one, because MAC addresses are sent in the clear and are easily spoofed: an attacker can sniff an allowed address and clone it. Treat MAC filtering as one thin layer, never as your real Wi‑Fi security.

Together with hiding nothing critical behind the SSID broadcast and changing default router passwords, these harden the most exposed doorway of a modern network — the one an attacker can attack from the pavement outside.

Layer 7 — Monitoring and logging: the layer that watches the layers

Every device — firewalls, servers, the IDS, the Wi‑Fi controller — writes logs: time‑stamped records of who connected, what was requested, what was allowed or denied. On their own these are scattered and unread. Organisations feed them into central monitoring (often a SIEM — Security Information and Event Management system) that correlates events across the whole network and looks for the story hidden in them.

Logging matters for three reasons, and none of them prevent an attack:

Detection. A single failed login is nothing; five thousand from one address in a minute is a brute-force attack in progress. Only the aggregated logs reveal the pattern.
Response and forensics. After a breach, logs are the record that lets investigators reconstruct how the attacker got in, what they touched, and which hole to close so it cannot happen again.
Accountability and deterrence. Knowing that actions are logged discourages misuse from inside, and satisfies legal and regulatory duties to keep records.

Monitoring is the nervous system running through the whole onion. It cannot stop anything by itself, but without it a breach can smoulder undetected for months — and you cannot defend against, or recover from, an attack you never knew happened.

Putting the onion together

Step back and the design is clear: no layer is asked to be perfect, because each assumes the ones outside it may have failed. The firewall thins the flood; segmentation contains whatever gets in; encryption denies eavesdroppers the payload; authentication and least privilege refuse to trust an intruder even inside; the IDS/IPS sounds the alarm and slams doors; secure Wi‑Fi and MAC filtering harden the wireless edge; and monitoring watches it all and remembers. Peel one layer and another lies beneath. That, and not any single clever product, is what network security actually is.

Two exam-and-real-life traps hide inside "defence in depth":

Never rely on one control. "We have a firewall, so we're secure" is exactly the mindset defence in depth exists to kill. Assume any single layer can fail — the firewall is misconfigured, the certificate expires, the IDS misses a novel attack — and combine several so a single failure is not a catastrophe. If losing one control would expose the core, you did not have depth; you had one wall painted to look like many.
The human layer bypasses the technical ones. Every control on this page can be walked straight past by a social-engineering attack. Why crack WPA3 or defeat a stateful firewall when you can phone an employee, pose as IT, and simply ask for their password and MFA code? The attacker who is handed valid credentials sails through authentication because, as far as every technical layer can tell, they are legitimate. That is why staff training and security culture are themselves a layer — arguably the most important one — and why a purely technical answer to "how do we secure this network?" is always incomplete.