Security › Module 2 › Lesson 1
Layered Controls
Defense-in-depth layers literacy names physical, network, host, application, and data layers — draft layer map rows on YOUR $ARCH_LAB fictional org LAB-ARCH-001 before control placement decisions.
Visual · t41_layers_named
Layers named literacy. $ARCH_LAB only. Original Cyberlium.
Opening
You cannot place controls without naming layers — literacy teaches defense-in-depth vocabulary so fictional org scenarios on $ARCH_LAB get documented before architecture reviews.
Defense in depth stacks independent control layers — physical perimeter, network segmentation, host hardening, application security, data protection — so failure of one layer does not collapse the entire posture. On Cyberlium you practice on fictional systems in YOUR $ARCH_LAB org template — lab web tier, example.local API, training database — never paste real employer network maps or live infrastructure VLAN exports into layer notes. Cyberlium maps layer row on YOUR $ARCH_LAB — layer name, example control, fictional system on LAB-ARCH-001 for one stack level. Next: Perimeter vs Zero Trust.
1. Defense-in-depth layers (named)
Physical: facility access, locks, cameras on YOUR fictional org. Network: firewalls, segmentation, IDS. Host: patching, EDR, hardening baselines. Application: secure SDLC, input validation, authZ. Data: encryption, classification, DLP at rest and in transit.
On $ARCH_LAB, write layer row — layer name, one example control, fictional LAB-ARCH-001 system it protects.
Command guide
Try these commands — Defense-in-depth layers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST 800-160 — https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final OWASP ASVS — https://owasp.org/www-project-application-security-verification-standard/ Microsoft SDL — https://www.microsoft.com/en-us/securityengineering/sdl/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export ARCH_LAB=${ARCH_LAB:-$HOME/cyberlium-lab/t41-arch}
curl -sS https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final | head -10
cat > "$ARCH_LAB/notes/security-architecture-named.txt" <<'EOF'
Security architecture — NAMED LITERACY:
Purpose: align security controls with business goals, risk, and system design
Artifacts: context diagrams, DFDs, trust boundaries, control catalogs, review checklists
Lifecycle: design → build → operate → evolve (not one-time diagram)
Stakeholders: architects, engineers, GRC, operations — fictional roles in lab
Context: LAB-ARCH-001 fictional SaaS — scope YOUR lab templates only
Lab: populate architecture stubs in Modules 4–5 — defensive literacy only
EOFCommand — copy this
grep -E 'Purpose|Artifacts|LAB-ARCH-001' "$ARCH_LAB/notes/security-architecture-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: NIST 800-160 (https://csrc.nist.gov/publications/detail/sp/800-160/vol-1/rev-1/final); OWASP ASVS (https://owasp.org/www-project-application-security-verification-standard/); Microsoft SDL (https://www.microsoft.com/en-us/securityengineering/sdl/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why layers precede single-control heroics
One firewall does not replace host hardening or application testing. Shared layer vocabulary aligns security, network, and development teams on the same design diagram. Version-controlled layer maps survive architecture review questions on lab templates.
Students draft lab layer maps on notes — production architecture follows enterprise standards and change control.
3. Lab boundary
Forbidden: copying real employer VLAN diagrams into lab layer maps as if fictional. Allowed: layers named card — one row per layer with $ARCH_LAB fictional system example.
Ship: layer map row for YOUR lab org system. Next: Perimeter vs Zero Trust.
4. What you ship: layer map row for $ARCH_LAB
Layer name, example control, fictional system. $ARCH_LAB named. chmod 600.
5. What you record before the next lesson
Date. Layer map row. $ARCH_LAB named. File t41-m02-l01-layers-named.txt chmod 600.
6. Wrong vs right: offensive playbooks vs YOUR threat models
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste employer network diagram into lab layer map. Skip data layer because 'network is enough.'
Right
Write layer map row for YOUR $ARCH_LAB fictional system. Next: Perimeter vs Zero Trust.
Mission: draft layer map on YOUR lab org
1) Name five defense-in-depth layers. 2) Assign one example control per layer. 3) Link to fictional LAB-ARCH-001 system. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Layer maps need system names — vague 'the server' fails review readability.
Knowledge Check
APPLY: Defense-in-depth layers on Cyberlium primarily:
Multiple choice
Knowledge Check
APPLY: True or False: Failure of one layer should not collapse entire posture when others exist.
True or False
Knowledge Check
APPLY: Layers named literacy on Cyberlium uses:
Multiple choice