A layered architecture is essential because no single control is sufficient. A firewall is a device or piece of software that filters network traffic according to rules; stateful firewalls track the state of network connections, while stateless firewalls examine each packet in isolation. A Web Application Firewall (WAF) filters HTTP traffic to and from web applications. Inside the network, Intrusion Detection Systems (IDS) monitor for malicious activity, Intrusion Prevention Systems (IPS) both detect and block it, and Security Information and Event Management (SIEM) platforms aggregate logs from many sources for threat detection. On endpoints, Endpoint Detection and Response (EDR) tools monitor and respond to threats, while Extended Detection and Response (XDR) unifies detection across endpoints, networks, and cloud environments.
Architectural patterns further limit how an attacker can move once inside. Network segmentation divides a network into smaller zones to contain breaches, and a demilitarized zone (DMZ) provides a buffer between an internal network and the internet. Microsegmentation pushes this idea to the workload level, separating east-west traffic (between internal systems) from north-south traffic (between internal and external networks). The zero trust security model replaces the legacy "trust but verify" stance with "verify and never trust," requiring every request to be authenticated and authorized regardless of where it originates. Modern implementations of this idea include Secure Access Service Edge (SASE), which combines networking and security in the cloud, Zero Trust Network Access (ZTNA), and Cloud Access Security Brokers (CASBs) that enforce policy across cloud applications.
Defenders also use deception and isolation. A honeypot is a decoy system designed to attract and study attackers. A sandbox is an isolated environment where suspicious code can be detonated safely to observe its behavior. Hardening reduces a system's attack surface through secure configuration, often guided by CIS Benchmarks. Data loss prevention (DLP) tools and processes aim to stop unauthorized exfiltration of sensitive data, while browser isolation runs web sessions in remote sandboxes to protect endpoints from malicious web content. Together these layers embody defense in depth.