Layered cyber security: the six layers every business needs

What is layered cyber security?

Layered cyber security means protecting your business with several overlapping controls, so that if one fails another still stands in the way. It is often called the onion model because each layer wraps around the one inside it.

No single tool stops every attack. Layering accepts that something will eventually get through, and limits how far an attacker can go.

Why does one layer never provide enough?

Every control has gaps. A firewall does not stop a staff member from approving a fake login request, and antivirus does not help if the only copy of your data is on a stolen laptop.

When layers work together, an attacker has to beat several defences in a row. That makes an attack slower, noisier and more likely to be noticed.

Layer 1: Why do your people come first?

Staff are the outermost layer, and the one attackers target most often. Phishing and social engineering work because they appeal to urgency and trust rather than technology.

A common example is an email that looks like it is from your cloud provider and warns that your account will be closed unless you update your password now. The link leads to a fake login page that captures what you type.

The best defence is practical, regular awareness training that uses realistic examples, plus a clear way for staff to report anything suspicious without feeling embarrassed. Add multi-factor authentication so a stolen password alone is not enough.

Layer 2: What does perimeter security protect?

The perimeter is where your network meets the internet. It typically includes your firewall, secure remote access, and filtering of web and email traffic.

The aim is to block what you do not want while allowing normal work. Keep firewall firmware current, close services you do not use, and review who has remote access.

Layer 3: How do you secure the network itself?

This layer controls what happens inside your network and on the links between your sites, devices and cloud services. The goal is that only known, authorised devices connect, and that traffic follows the rules you set.

Practical steps include:

• Separating guest Wi-Fi from business systems.
• Keeping unmanaged devices, such as printers and smart gadgets, on their own network segment.
• Encrypting data that travels over the internet.
• Reviewing which devices are connected, and removing those that are not needed.

Layer 4: What should endpoint security cover?

Endpoints are the laptops, desktops, tablets and phones your team uses every day. Because staff use them constantly, they are also a common way in.

Good endpoint protection includes security software that is monitored, automatic patching of operating systems and applications, disk encryption, and a way to lock or wipe a lost device. Remove local administrator rights where staff do not need them.

Layer 5: How do you protect the data itself?

Data does not sit in one place. It lives in email, file shares, cloud storage, laptops and line-of-business applications.

Start by knowing where your sensitive information is held and who can open it. Then apply the controls that matter:

1. Give people access only to what their role needs.
2. Encrypt sensitive data at rest and in transit.
3. Keep tested, separate backups so you can recover if data is lost or locked.
4. Remove accounts and shared links when people leave or projects end.

If you hold personal information, privacy obligations under Australian law apply, including requirements that may follow a data breach. A good starting point is our guide on why data backups are key to protecting your data.

Layer 6: What is the core, and who gets access to it?

The core is where your most critical systems and information sit, such as financial platforms, customer databases and administrator accounts. If an attacker reaches it, the damage is greatest.

Restrict this layer tightly. Limit the number of administrator accounts, use separate accounts for admin work, require stronger authentication, and log what happens so unusual activity can be seen.

Avoid concentrating too much access in one person. If a single account can reach everything, that account becomes the target.

What does a layered approach cost?

Layering does not have to mean buying a long list of products. Several of the most useful controls, such as multi-factor authentication, automatic updates and tested backups, are inexpensive or already included in tools you pay for.

The cost is mostly in setting them up properly and keeping them maintained. That is where a managed provider can save you time.

How do you find the gaps in your layers?

Walk through each layer and ask three questions. What do we have here, who is responsible for it, and when did we last test it?

The Australian Cyber Security Centre publishes the Essential Eight, a set of mitigation strategies that overlap with many of these layers, such as patching, multi-factor authentication and backups. Fast Response IT helps businesses work towards them in a practical, staged way.

Pay particular attention to the layers nobody owns. Gaps usually appear where responsibility is unclear, such as an old firewall no one reviews or a shared account no one remembers creating.

How does layered security relate to ransomware?

Ransomware is a good test of your layers. It usually arrives through a person, runs on a device, spreads across the network and then goes after data.

Each layer gives you a chance to stop or limit it. Our guide to preventing ransomware in a small business shows how these controls fit together in practice.

How can Fast Response IT help?

Fast Response IT provides cyber security services for small and medium businesses in Sydney, covering the layers above from awareness and access controls to monitoring, patching and backups.

To see where your protection is strongest and weakest, try the cyber risk check.