Cybersecurity Foundations (Grades 6–8) · lesson 22 of 48 · 12 min
Why No Single Defence Is Enough
There is no such thing as a perfect security control. Antivirus misses zero-day malware. Firewalls can be bypassed. Even the strongest password can be phished. This is why cybersecurity professionals use defence in depth — layering multiple security controls so that if one fails, others are still in place.
Think of it like a medieval castle: moat, outer wall, inner wall, keep, and guards. An attacker must breach every layer. Each layer buys time and increases the chance of detection.
By the end of this lesson you will be able to explain the defence in depth principle, describe eight essential personal security layers, apply the 3-2-1 backup rule, and explain why each layer matters with real examples.
The cost of not defending
The average cost of a data breach in 2023 was $4.45 million (IBM Cost of a Data Breach Report). For individuals, the average cost of identity theft recovery is over $1,000 in direct costs and hundreds of hours of time. Most breaches are preventable with basic security hygiene. The cost of prevention is always lower than the cost of recovery.
Layered Security (Defence in Depth)
1. Keep software updated — most malware exploits known vulnerabilities that have already been patched. Updates close these holes. Enable automatic updates for your OS, browser, and apps.
2. Use antivirus/anti-malware — detects and removes known malware. Not perfect (cannot catch zero-days) but essential. Windows Defender is built-in and effective.
3. Use a firewall — blocks unauthorised network connections. Windows and macOS have built-in firewalls. Enable them.
4. Strong, unique passwords + MFA — covered in L4 and L5. The most impactful personal security steps.
5. Be sceptical of links and attachments — pause before clicking. Verify unexpected emails. Most infections require user action.
6. Back up your data — the best defence against ransomware. Follow the 3-2-1 rule: 3 copies, 2 different media types, 1 offsite (cloud).
7. Use HTTPS — only enter sensitive information on sites with HTTPS (padlock icon).
8. Secure your Wi-Fi — use WPA3 or WPA2 encryption. Change the default router password. Use a guest network for IoT devices.
The 3-2-1 backup rule
3 copies of your data. 2 different storage types (e.g., external drive + cloud). 1 copy offsite (cloud or at a different location). This ensures you can recover from ransomware, hardware failure, fire, or theft.
Key Terms
Knowledge Check
Basic Defense Strategies
Defence in depth means:
- Having one very strong password
- Using multiple security layers so one failure does not compromise everything
- Defending against deep web threats
- Using the most expensive security tools
- Answer: Using multiple security layers so one failure does not compromise everything
Defence in depth layers security controls — if malware bypasses antivirus, a firewall may block its C2 connection; if that fails, backups allow recovery. The 3-2-1 backup rule means:
- 3 passwords, 2 accounts, 1 email
- 3 copies, 2 different media types, 1 offsite
- 3 backups per day, 2 per week, 1 per month
- 3 cloud services, 2 drives, 1 USB
- Answer: 3 copies, 2 different media types, 1 offsite
3-2-1 ensures you can recover from any single failure — ransomware, hardware failure, fire, or theft.
Why are software updates critical for security?
- They add new features
- They close known vulnerabilities that malware exploits
- They make computers faster
- They improve battery life
Answer: They close known vulnerabilities that malware exploits
Most malware exploits known vulnerabilities. Updates (patches) close these holes. Unpatched systems are easy targets.
The best defence against ransomware is:
- Antivirus software
- Regular backups following the 3-2-1 rule
- A strong password
- A firewall
- Answer: Regular backups following the 3-2-1 rule
If ransomware encrypts your files, backups let you restore without paying. Antivirus may not catch new ransomware variants. WPA3 is used to:
- Encrypt email
- Secure wireless network traffic
- Protect passwords
- Filter web content
- Answer: Secure wireless network traffic
WPA3 is the current Wi-Fi security standard. It encrypts wireless traffic so nearby attackers cannot intercept your data.
Antivirus software can detect all malware, including zero-day threats.
Answer: False
Antivirus uses signature databases — it can only detect known malware. Zero-day malware (no signature yet) can bypass antivirus.
Activity — Defence in Depth Matching
Security Layer vs. Threat It Defends Against
Worked Example — Applying Defence in Depth
How layered defences stopped a ransomware attack
Layer 1 — Email filter A phishing email with a malicious attachment is caught by the school’s email spam filter. 95% of similar emails are blocked here. Layer 2 — User awareness One email gets through. The student recognises the suspicious sender address and does not open the attachment. Most infections are stopped here. Layer 3 — Antivirus A student on another computer opens a similar attachment. Antivirus detects the known ransomware signature and quarantines it. Layer 4 — Firewall A new variant bypasses antivirus. The firewall blocks the ransomware’s attempt to contact its C2 server — it cannot receive the encryption key and cannot encrypt files. Layer 5 — Backups In the worst case, ransomware encrypts files. The school restores from yesterday’s backup. Total data loss: less than 24 hours of work. No ransom paid.
Real-World Case Studies
Case 1: The school that paid ransom (2019)
The Rockville Centre School District in New York paid $88,000 in ransom after a ransomware attack encrypted their systems. Many other school districts have paid far more. The common thread: no tested backups, no network segmentation, and outdated software. The lesson: the 3-2-1 backup rule and regular patch management would have prevented the need to pay entirely.
Case 2: How a firewall saved a hospital during WannaCry
During the 2017 WannaCry outbreak, some hospitals were unaffected despite running unpatched Windows systems. The reason: their firewalls blocked the SMB port (445) that WannaCry used to spread. Defence in depth meant that even though one layer (patching) had failed, another layer (firewall) held. The lesson: multiple layers mean multiple chances to stop an attack.
Previous lesson: How malware spreads
Back to Cybersecurity Foundations (Grades 6–8)
Next lesson: What is encryption?