Skip to main content

Layered approach to security

Short answer

Security is protecting information and systems from unauthorized access, ensuring confidentiality, integrity, and availability. A layered approach is needed because no single control is perfect; multiple layers contain failures and make attacks harder. It is possible to have less security for higher throughput by removing controls, but not desirable as breaches cause greater losses, and weak security invites attacks that degrade performance anyway.

What do you mean by security? Why do we need a layered approach to managing security? Is it desirable / possible to have less secured system and still have high throughput and performance? Explain.

Security

Security is the protection of information, systems and resources from unauthorized access, modification, destruction or disruption, while keeping them available to authorized users. Its main goals are confidentiality, integrity and availability.

Why a layered approach

  • No single control is perfect. Firewalls can be bypassed, passwords stolen, software has bugs.
  • If one layer fails, other layers still protect the asset (defence in depth).
  • Threats come from many directions (network, host, application, people, physical), so different controls are needed for each.
  • It makes an attack more costly and time consuming and gives time for detection and response.
  • It allows different teams and tools to manage specific layers, and failures stay contained.

Typical layers: physical, perimeter (firewall), network, host, application, data, and people/policy.

Less security with high throughput?

Technically it is possible, because security controls (encryption, scanning, authentication checks, logging) use CPU, bandwidth and time, so a system with few controls can respond faster. But it is not desirable:

  • A fast but insecure system risks data theft, fraud, downtime and legal penalties; the loss is much greater than the performance gain.
  • Attacks such as DoS and malware also reduce performance and availability, so weak security can lower real throughput.

The practical solution is a balance: apply controls according to risk, use hardware acceleration (SSL offloading), efficient algorithms, caching, load balancing and more powerful hardware, and give stronger protection to sensitive data and lighter controls to public data.

✓ Answer checked by Claude Opus 5.5 (high effort)

Related questions

All Information System chapter 2 questions →