L36
Defense in depth and hardening
Cram this first — memory hook
Lock the building, verify the person, limit the route, protect the data, watch activity, prepare recovery.
Exam trap
Five identical perimeter firewalls are not automatically stronger defense in depth than controls addressing several different failure paths.
The slide facts
The perimeter alone is insufficient because cloud, remote, mobile and Internet of Things systems extend the network edge. Hardening changes defaults, reduces services and limits access.
If you have time — extra
Defense in depth uses complementary protections so one failure does not expose everything. A firewall filters traffic, but a stolen valid account or a malicious insider may bypass assumptions about the perimeter. Combine physical access control, strong authentication, least privilege, segmentation, secure configurations, encryption, monitoring and recovery. Device hardening removes avoidable exposure: change default credentials, disable unused services, replace insecure management protocols, patch under a managed process and restrict administrative access. These controls have different jobs. A backup supports recovery after harm; it does not prevent someone viewing a file today. A camera helps detection/forensics but does not itself block a network connection. Avoid claiming a layered design guarantees safety; assess which threat each layer addresses.
Walkthrough
Identify the likely entry path and valuable assets, place controls at several relevant stages, check dependencies and remaining single points of failure, then validate and monitor the design.