No single defence is perfect, so good networks use several layers, each one catching what gets past the last. It's called defence in depth, and it's the same idea as a castle with a moat, walls and a keep.
Segmentation splits a network into zones, so one break-in doesn't open everything. The guest Wi-Fi, the office computers, the payment machines and the servers each get their own subnet or VLAN (a virtual LAN: separate networks sharing the same switches), with a firewall between them that allows only what each zone needs.
Least privilege means every person, program and device gets only the access it needs. The receptionist's computer doesn't need to reach the database; the website's server doesn't need to start connections out to the internet. Zero trust takes it further: don't trust anything just because it's inside the network, and check every connection.
Keep systems updated, since most attacks use holes that already have fixes. Use strong sign-in: a password manager, unique passwords, and two-factor authentication, ideally passkeys or security keys. Close what isn't used: every open port and running service is one more thing to defend.
Finally, assume something will get through and plan for it. Logs and monitoring show what happened and when. Backups, kept offline or somewhere an attacker can't delete them, mean ransomware is an inconvenience instead of a disaster. And a written plan for what to do saves time when it matters.
What does defence in depth mean?
| Defence in depth | Several layers, not one wall. |
|---|---|
| Segmentation | Separate zones (subnets, VLANs) with rules between. |
| VLAN | A separate network on shared switches. |
| Least privilege | Only the access that's needed. |
| Zero trust | Check every connection, inside or not. |
| Backups | Offline or out of an attacker's reach. |