Security Architecture · Topic 5 of 12
Defense in Depth and Segmentation
Apply control types, layered defenses, security zones, device placement, microsegmentation, network access control, VPN and SASE in architecture.
- 5 min
- Includes a diagram
- Defense in depth uses several different layers, so no single failure is fatal.
- Controls have categories (technical, managerial, operational, physical) and types (preventive, detective, corrective and others).
- Compensating controls substitute for a control that cannot be applied.
What it is
Secure architecture arranges controls so that one failure does not give an attacker everything. The core idea is defense in depth: several independent layers, so that a bypass of one is caught by another.
Good designs also reduce the attack surface by removing unneeded services and by dividing the network into zones with controlled paths between them.
How it works
Control categories and types
Controls are described by what they are made of and by what they do.
| Category | Examples |
|---|---|
| Technical | Firewall, encryption, access control list |
| Managerial | Policy, risk assessment, security review |
| Operational | Training, change procedures, guard patrols |
| Physical | Locks, fences, badge readers |
| Type | Purpose | Example |
|---|---|---|
| Preventive | Stop an event | Firewall rule, multi factor authentication |
| Deterrent | Discourage an attacker | Warning banner, visible cameras |
| Detective | Notice an event | Intrusion detection, log review |
| Corrective | Limit damage and restore | Patch, restore from backup |
| Compensating | Substitute when the ideal control is not possible | Extra monitoring on an unpatchable system |
| Directive | Instruct behavior | Acceptable use policy |
A single measure can fit several types. A camera deters and also detects.
Layers of defense
Layers cover the network, host, application, data and identity, and also people and physical access. Diversity of controls matters: two firewalls from the same vendor with the same flaw count as one layer. Least privilege and separation of duties reduce the damage from any single account.
Security zones and device placement
!Zones from the untrusted internet through an edge firewall to a DMZ holding a reverse proxy and load balancer and a public facing server, then an internal firewall in front of an internal zone and a restricted zone for sensitive data, with an out of band IDS fed by a mirror port on the internal switch. A zone groups assets that share trust and policy, with traffic between zones filtered. Typical zones are the untrusted internet, a demilitarized zone (DMZ) for public facing servers, internal user and server zones, a management zone and a restricted zone for sensitive data.
Placement of devices matters.
| Device | Typical placement | Note |
|---|---|---|
| Firewall | Between zones | Next generation firewalls inspect applications and users |
| Intrusion prevention system (IPS) | Inline | Can block, but a failure can break traffic |
| Intrusion detection system (IDS) | Out of band, using a mirror port or tap | Passive, cannot block by itself |
| Web application firewall (WAF) | In front of web applications | Filters Hypertext Transfer Protocol (HTTP) attacks |
| Reverse proxy and load balancer | In the DMZ | Hides back end servers |
| Jump server or bastion | At the zone edge of management networks | Single audited path for administration |
Inline devices stop attacks but add a point of failure, so decide on fail open or fail closed behavior. Out of band devices are safe for availability but only alert.
Segmentation and microsegmentation
Segmentation uses virtual local area networks (VLANs), subnets, firewalls and routing to limit movement between systems. It shrinks the blast radius of a breach and eases compliance scoping, since a payment segment can be audited on its own.
Microsegmentation applies policy at the level of individual workloads, often in software at the hypervisor, host or container. It controls east west traffic, which is traffic between servers inside a data center, where a traditional perimeter firewall does not see it.
Network access control and remote access
Network access control (NAC) checks a device's identity and health before it joins a network. It can place non compliant devices in a quarantine segment. The Institute of Electrical and Electronics Engineers (IEEE) 802.1X standard is a common mechanism for port based authentication.
A virtual private network (VPN) encrypts remote access over untrusted networks. A split tunnel sends only corporate traffic through the VPN, while a full tunnel sends everything, which is easier to inspect but uses more bandwidth.
Cloud delivered security services
Secure Access Service Edge (SASE) combines wide area networking (WAN) such as software defined WAN (SD-WAN) with cloud delivered security. Security Service Edge (SSE) is the security half of SASE. Typical SSE functions are a secure web gateway, a cloud access security broker (CASB), zero trust network access (ZTNA) and firewall as a service.
What to remember for the exam
- Defense in depth uses several different layers, so no single failure is fatal.
- Controls have categories (technical, managerial, operational, physical) and types (preventive, detective, corrective and others).
- Compensating controls substitute for a control that cannot be applied.
- Inline devices block but can break traffic, while out of band devices only alert.
- Segmentation limits lateral movement and narrows compliance scope.
- Microsegmentation controls east west traffic between workloads.
- NAC checks identity and health before allowing a device on.
- SSE is the security part of SASE and includes secure web gateway, CASB and ZTNA.
When a question asks how to contain an attacker who is already inside, think segmentation and microsegmentation, not a stronger perimeter.
Common mistakes
Counting identical layers as depth. Two products with the same engine or same flaw fail together.
Putting an IPS out of band and expecting blocking. A passive sensor cannot stop traffic.
Assuming a DMZ is trusted. It holds exposed servers, so it must be treated as a likely compromise point and isolated from the inside.
Relying on VLANs alone. Without filtering between them, they only separate broadcast domains.
A firewall that fails open during an outage removes your main control, so decide the failure mode before deployment.
Check yourself
Work through these three questions.
Which control type is extra monitoring on a system that cannot be patched?
Compensating.
What traffic does microsegmentation mainly protect?
East west traffic between workloads inside the network, which a perimeter firewall does not see.
What is the difference between IDS and IPS placement?
An IDS sits out of band and only alerts, while an IPS sits inline and can block traffic.
Topic 5 of 12 in Security Architecture
Test yourself on Security Architecture
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.