--- title: "Layered approach to security" subject: "Information System" chapter: 2 key: "semester_8/information_system:layered-security-throughput" source: https://www.bctengineer.com/q/semester_8/information_system/layered-security-throughput site: BCT Engineering --- # Layered approach to security Information System · Chapter 2: Control, Audit and Security of Information Systems - Asked in: 2073 Magh, 2+2+4 marks - Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14 - Page: https://www.bctengineer.com/q/semester_8/information_system/layered-security-throughput - Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2 ## Question What do you mean by security? Why do we need a layered approach to managing security? Is it desirable / possible to have less secured system and still have high throughput and performance? Explain. ## Short answer Security is protecting information and systems from unauthorized access, ensuring confidentiality, integrity, and availability. A layered approach is needed because no single control is perfect; multiple layers contain failures and make attacks harder. It is possible to have less security for higher throughput by removing controls, but not desirable as breaches cause greater losses, and weak security invites attacks that degrade performance anyway. ## Answer #### Security **Security** is the protection of information, systems and resources from unauthorized access, modification, destruction or disruption, while keeping them available to authorized users. Its main goals are confidentiality, integrity and availability. #### Why a layered approach - **No single control is perfect.** Firewalls can be bypassed, passwords stolen, software has bugs. - If one layer fails, other layers still protect the asset (defence in depth). - Threats come from many directions (network, host, application, people, physical), so different controls are needed for each. - It makes an attack more costly and time consuming and gives time for detection and response. - It allows different teams and tools to manage specific layers, and failures stay contained. Typical layers: physical, perimeter (firewall), network, host, application, data, and people/policy. #### Less security with high throughput? Technically it is **possible**, because security controls (encryption, scanning, authentication checks, logging) use CPU, bandwidth and time, so a system with few controls can respond faster. But it is **not desirable**: - A fast but insecure system risks data theft, fraud, downtime and legal penalties; the loss is much greater than the performance gain. - Attacks such as DoS and malware also reduce performance and availability, so weak security can lower real throughput. The practical solution is a balance: apply controls according to risk, use hardware acceleration (SSL offloading), efficient algorithms, caching, load balancing and more powerful hardware, and give stronger protection to sensitive data and lighter controls to public data. ## Check yourself The answer's key points as multiple-choice questions, with the correct option and why. 1. Why is a layered approach needed? A. No single control is perfect, so other layers cover a failure B. Firewalls never fail C. Layers make attacks cheaper D. Only one team can manage security Answer: A. Layering also slows attackers and contains failures. (Key point: Why layered) 2. Is a less secured system with high throughput possible? A. Impossible because security never costs performance B. Possible, because controls use CPU, bandwidth and time, but not desirable C. Desirable because losses are small D. Possible and recommended for all systems Answer: B. Fewer controls respond faster, but the risk of loss is greater. (Key point: Is it possible) 3. How can weak security lower real throughput? A. Encryption always adds speed B. Attackers help balance load C. DoS and malware attacks reduce performance and availability D. Weak security reduces costs only Answer: C. So the apparent gain is not real. (Key point: Weak security effect) 4. Which is the practical solution? A. Remove all security B. Apply maximum security to public data C. Never upgrade hardware D. Apply controls according to risk and use SSL offloading, caching and load balancing Answer: D. Stronger protection goes to sensitive data and lighter controls to public data. (Key point: Balance) ## Related in Information System - [IS security threats and safeguards](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ais-security-threats-controls) — Information System, chapter 2 - [Threats, controls and security measures](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-threats-controls-measures) — Information System, chapter 2, asked 3× - [Security audit and security protocols](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-audit-role-protocols) — Information System, chapter 2 - [Process of developing IS security plan](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ais-security-plan) — Information System, chapter 2 - [Multi-layer security strategy](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Amulti-layer-security-ecommerce) — Information System, chapter 2 - [Need of IS and balanced scorecard](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Awhy-need-is-balanced-scorecard) — Information System, chapter 1 ## Related in other subjects - [Why do we need DFT](https://www.bctengineer.com/question.md?key=semester_7%2Fdigital_signal_analysis_and_processing%3Awhy-need-dft) — Digital Signal Analysis and Processing, chapter 7, asked 6× - [Why do we need FFT](https://www.bctengineer.com/question.md?key=semester_7%2Fdigital_signal_analysis_and_processing%3Awhy-need-fft) — Digital Signal Analysis and Processing, chapter 7, asked 2× - [Define throughput of a system](https://www.bctengineer.com/question.md?key=semester_6%2Fembedded_system%3Adefine-throughput) — Embedded System, chapter 1 - [Power system security assessment](https://www.bctengineer.com/question.md?key=semester_8%2Fpower_plant_design%3Asecurity-assessment-components) — Power Plant Design, chapter 2