---
title: "Multi-layer security strategy"
subject: "Information System"
chapter: 2
key: "semester_8/information_system:multi-layer-security-ecommerce"
source: https://www.bctengineer.com/q/semester_8/information_system/multi-layer-security-ecommerce
site: BCT Engineering
---

# Multi-layer security strategy

Information System · Chapter 2: Control, Audit and Security of Information Systems

- Asked in: 2072 Magh, 5 marks
- Video: [Cyber Defense in Depth Explained | The Multi-Layer Security Strategy](https://www.youtube.com/watch?v=po-xPAqghkc) — NextGen Academy
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_8/information_system/multi-layer-security-ecommerce
- Whole chapter: https://www.bctengineer.com/md/semester_8/information_system/chapter-2

## Question

What is a multi layer security strategy? Discuss how multi layer security strategy can be applied to protect e-commerce systems.

## Short answer

A multi-layer security strategy uses independent protective layers (people, physical, perimeter, network, host, application, data, identity, payment) so failure of one layer doesn't compromise the system. For e-commerce, it applies layers from secured data centre and firewalls to encrypted customer data, PCI-DSS compliance, two-factor authentication, and staff training, reducing risk by forcing attackers to defeat multiple controls.

## Answer

A **multi-layer security strategy** (defence in depth) uses several independent layers of protection so that if one layer fails, the others still protect the system. No single control is trusted alone.

```text
 Policy, training (people)
   Physical security
     Perimeter: firewall, IDS
       Network: VPN, segmentation
         Host: antivirus, patches
           Application: input checks
             Data: encryption, backup
```

#### Applying it to an e-commerce system
1. **Physical layer** - secured data centre, access control, CCTV, UPS.
2. **Perimeter layer** - firewall and DMZ for the web server, IDS/IPS, DDoS protection.
3. **Network layer** - HTTPS/SSL/TLS, VPN for admin access, network segmentation (web, application and database servers on separate segments).
4. **Host layer** - hardened operating systems, antivirus, regular patches.
5. **Application layer** - input validation against SQL injection and XSS, secure session handling, web application firewall, secure coding.
6. **Data layer** - encrypted customer and card data, tokenization of card numbers, PCI-DSS compliance, regular backups.
7. **Identity layer** - strong passwords, OTP/two-factor login, role-based access for staff, digital certificates.
8. **Payment layer** - trusted gateway, 3-D Secure.
9. **Human/procedural layer** - security policy, staff training, monitoring logs, audits, incident response plan.

Benefit: an attacker must defeat many layers, risk is reduced and failures are contained.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. What is the idea of a multi-layer security strategy?
   A. One strong firewall is enough
   B. If one layer fails, other independent layers still protect the system
   C. Only the data layer matters
   D. Layers all share a single control
   Answer: B. No single control is trusted alone. (Key point: Defence in depth)

2. Which controls belong to the perimeter layer in e-commerce?
   A. Firewall, DMZ, IDS/IPS and DDoS protection
   B. Input validation and WAF
   C. Encrypted card data
   D. Staff training
   Answer: A. Application and data layers are separate. (Key point: Perimeter layer)

3. Which is an application layer control against SQL injection and XSS?
   A. UPS and CCTV
   B. VPN segmentation
   C. Input validation and secure coding
   D. Card tokenization
   Answer: C. Application-level threats are handled by validation, WAF and session handling. (Key point: Application layer)

4. Which belongs to the data layer?
   A. Guards and CCTV
   B. Firewalls
   C. Antivirus patches
   D. Encrypted card data, tokenization and backups
   Answer: D. Data layer protects stored customer and card data, with PCI-DSS compliance. (Key point: Data layer)

## Related in Information System

- [Threats, controls and security measures](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Asecurity-threats-controls-measures) — Information System, chapter 2, asked 3×
- [IS security threats and safeguards](https://www.bctengineer.com/question.md?key=semester_8%2Finformation_system%3Ais-security-threats-controls) — Information System, chapter 2

## Related in other subjects

- [Grounding and coupling in multi-layer PCB](https://www.bctengineer.com/question.md?key=semester_5%2Finstrumentation_ii%3Apcb-multilayer-grounding) — Instrumentation II, chapter 8
- [Network security and firewalls](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Anetwork-security-firewall-protect) — Computer Networks and Security, chapter 8
- [Functions of data link layer](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Adll-functions) — Computer Networks and Security, chapter 3, asked 3×
- [Data link layer framing](https://www.bctengineer.com/question.md?key=semester_7%2Fcomputer_networks_and_security%3Aframing-mechanisms) — Computer Networks and Security, chapter 3, asked 3×