Why one kind of protection is not enough
An attack can come from many sides. A thief walks in through a door. A virus comes through the network. A cheat sends a fake email to a person. One tool cannot stop all three.
So we use three kinds of measures together: human, technical and physical. Using many layers is called defence in depth. If one layer fails, the next one still protects you.
Human security measures
People are often the weakest link. A strong lock is useless if someone gives away the key. Human measures aim to make people careful and honest.
- Training and awareness: teach everyone how to spot phishing and fake calls.
- Rules: do not share passwords, lock your screen, do not plug in unknown USB sticks.
- Roles and duties: each person gets only the access the job needs (least privilege). Two people check important jobs.
- Hiring and leaving: check new staff, and remove access the day someone leaves.
- Reporting: make it easy and safe to say "I clicked something odd".
Technical security measures
Technical measures are done by software and hardware.
- Authentication: passwords, one-time codes (OTP), fingerprints, two-step login.
- Access control: a file can be read only by people who are allowed.
- Encryption: scramble data so a stolen copy cannot be read.
- Firewall: filters the traffic that enters or leaves a network.
- Antivirus and updates: find known malware; updates close known holes.
- Backups and logs: a spare copy of data, and a record of who did what.
Physical security measures
Physical measures protect the real things: rooms, computers, cables, paper and people.
- Locks, ID cards, biometric doors so only allowed people enter.
- Guards, CCTV cameras, visitor registers.
- Safe rooms for servers, with fire alarms, extinguishers and backup power (UPS).
- Cable locks, screen filters, and shredding old papers.
- Safe disposal: wipe or destroy old disks before throwing them away.
Try it
Try it in the 3D: switch on only the People layer. Which attack gets in? Now switch on only Technical. Guess first, then check the readout under the picture.
Try it at home: list three things in your house that protect your phone: a screen lock (technical), a drawer or bag (physical) and a family rule such as "no sharing the PIN" (human).
Key formulas and definitions
- Key terms: human = people and rules; technical = software and hardware; physical = places and things.
- Defence in depth = many layers, so one failure does not mean a breach.
- Least privilege = give each person only the access they need.
- Backup rule 3-2-1: 3 copies, 2 kinds of storage, 1 copy kept away.
Worked examples
1. A bank locks its server room with an ID-card door. Which kind of measure is this?
Physical. It controls who can enter a place.
2. A company teaches staff to spot phishing emails. Which kind of measure is this?
Human. It trains people to act safely.
3. A school turns on two-step login for its portal and encrypts the marks file. Name the measures and their kind.
Two-step login is authentication and encryption hides the data. Both are technical measures.
4. A laptop is stolen from a car. The disk was encrypted. Which measures helped and which failed?
Physical failed: the laptop was left unattended. Technical helped: encryption keeps the data unreadable. A human rule such as "never leave a laptop in a car" would have prevented the theft.
Common mistakes
- Thinking antivirus alone makes a computer safe. It does not stop a thief or a fake call.
- Forgetting people: most attacks start with a trick played on a person.
- Giving everyone full access "to save time". Use least privilege.
- Never testing the backup. A backup you cannot restore is no backup.