Defense in depth is the principle that security should come from multiple independent layers, so that the failure of any one control does not lead to compromise. It is an old idea, and in OT it is not optional, because the systems at the center often cannot defend themselves at all.
Controllers that lack authentication, devices that cannot be patched and protocols with no encryption put almost the entire security burden on the layers around them. This article looks at what those layers are, how they fit together, and where reducing reachability sits among them.
01Key takeaways
- 01
Defense in depth layers independent controls so no single failure leads to compromise.
- 02
In OT it is essential because the core systems are often unable to protect themselves.
- 03
The layers span physical security, network segmentation, access control, monitoring and recovery.
- 04
One-way transfer and disconnection are powerful layers because they remove reachability rather than watch it.
- 05
Effective defense in depth means layers that genuinely back each other up, not many controls at the same point.
02What defense in depth means in OT
Defense in depth assumes that any single control can fail or be bypassed, and arranges multiple layers so that an attacker must defeat several to succeed. The strength comes from independence: each layer should catch what the others miss.
In OT this is not a best practice so much as a necessity. Guidance such as CISA's recommended practices and IEC 62443 is built around layering precisely because the endpoints, the controllers and devices, frequently cannot be secured directly.
When the system at the center cannot defend itself, the layers around it are the defense.
03Why single controls fail
Relying on one control is fragile because every control has failure modes. A firewall rule drifts, a credential is stolen, a sensor misses an event, a patch is delayed. If everything depends on that one control, its failure is a breach.
Layering changes the math. For an attacker to reach a controller, they must get past the network boundary, and the segmentation, and the access controls, and avoid detection, and so on. Each independent layer that must be defeated lowers the chance of a successful, undetected attack.
04The layers
- Physical
- Controlling who can physically reach devices, ports and media, since physical access often bypasses every network control.
- Network segmentation
- Dividing the environment into zones with controlled conduits so an incident cannot spread freely.
- Access control
- Restricting who and what can connect, with strong identity and least privilege, including for vendors.
- Monitoring
- Visibility into the environment to detect anomalies, ideally without creating new inbound paths.
- Recovery
- Protected, tested backups and rebuild procedures so operations can be restored if a layer is breached.
05Where one-way transfer and disconnection sit
Most controls in a defense-in-depth stack manage or watch connectivity. One-way transfer and time-based disconnection are different and powerful because they remove connectivity, eliminating whole categories of attack rather than monitoring for them.
A one-way boundary means an attacker cannot send anything back through it, no matter what else fails. A disconnected-by-default segment cannot be reached at all outside its windows. An AIRGAPNET controlled connectivity pattern adds this kind of layer: a hardware-enforced reduction in reachability that holds even when software controls around it do not.
These layers are valuable precisely because they fail closed. Where a firewall rule can be misconfigured into openness, a removed path stays removed.
06Avoiding defense in breadth
A common failure is to mistake many controls for defense in depth. Stacking several tools at the same point, all watching the same boundary in the same way, is breadth, not depth. If they share a weakness, they fail together.
Real depth comes from layers that are independent and cover different stages of an attack. The test is simple: if this layer fails, does another genuinely stand between the attacker and the goal? Diversity of control type, physical, network, access, monitoring, recovery, is what makes the depth real.
07Closing thought
Defense in depth is the honest response to a hard truth: in OT, the systems you most need to protect are often the least able to protect themselves. The answer is not a single perfect control but a set of independent layers that each assume the others might fail.
Build the layers deliberately, make them independent, and include controls that remove reachability outright, not just watch it. The fragility of the core becomes manageable when the layers around it are strong, diverse and designed to fail closed.
FAQFrequently asked questions
What is defense in depth in OT?
Defense in depth is the principle of using multiple independent security layers so that the failure of any one control does not lead to compromise. In OT it is essential because the core controllers and devices often cannot defend themselves directly.
What are the layers of defense in depth for OT?
They span physical security, network segmentation, access control, monitoring and recovery. Each layer should be independent and cover a different stage of an attack so that the others catch what any one misses.
Why is a single security control not enough for OT?
Every control has failure modes: rules drift, credentials are stolen, detection misses events, patches are delayed. If everything depends on one control, its failure is a breach. Layering forces an attacker to defeat several independent controls.
Where do one-way transfer and disconnection fit in defense in depth?
They are powerful layers because they remove connectivity rather than watch it, eliminating whole categories of attack. A one-way boundary cannot carry traffic back, and a disconnected-by-default segment cannot be reached outside its windows, so they fail closed.
What is the difference between defense in depth and defense in breadth?
Defense in breadth stacks many controls at the same point, watching the same boundary the same way, so they can fail together. Defense in depth uses independent layers covering different attack stages, so if one fails another still stands in the way.
SRCSources of record
Layers that fail closed
Add a layer that removes reachability instead of watching it.
Complement segmentation, access control and monitoring with hardware-enforced one-way or disconnect-by-default boundaries that hold even when software controls fail.