Go to Advice start page

Please Protect Yourself - Layer Your Defenses

One of the earliest ways of making yourself safe in the Internet was not letting yourself be seen. There are many forms of Security By Obscurity, and they all sound logical.

Security By Obscurity, which may or may not be a good idea, does not replace a good layered defense. Each layer is necessary, because no single layer can produce complete protection. And consider each component carefully, and uniquely, for each network or person being protected.

Now if you're just getting started here, this advice may seem like a lot to take in at once. And it is just that, so take your time reading. Consider one layer at a time, and ask questions.


▲ Top

What is a layered defense?
Start by considering a typical medieval castle - classically, one of those would have:

Each one of these elements was designed to be enough to protect the inhabitants against intruders. Frequently, though, the intruders would breach the outer defenses, and the inner defenses were needed to protect the owners (though not all the inhabitants) of the castle.

A layered defense for your network is similar to a castle in concept. The outer layers should be sufficient, but in case an intruder gets thru one layer, you have another layer protecting you. Better too much protection than not enough.

▲ Top

Layer 1 - Perimeter Network Protection
First, you need to protect your perimeter - the outer edge of your network. Perimeter protection, such as a NAT router, is the first layer in a good layered defense.

A NAT router acts as a firewall, in that it passes only requested traffic back to the computer that requested it. It won't selectively filter traffic from hostile addresses, nor selectively filter bad protocols or programs, however. Some NAT routers also contain firewall components, but they will probably not be as comprehensive, or as configurable, as an ICSA certified firewall.

For more information about firewalls in general:

Please don't confuse the perimeter firewall, which is hardware based, with a personal firewall, which is generally software based. Personal firewalls are discussed in Layer2.

One firewall or NAT router protects your entire LAN, and is a good idea even if your LAN consists of only one computer. A NAT router today is equivalent in concept to perimeter protection, which was considered sufficient 5 years ago. Now we know to use multi-layered defense (aka layered defense).

All NAT routers don't have the same features. Some are designed for special needs.


One of the problems with the medieval moat was that it only protected against ground based attacks. The attackers could stand well outside the castle, and fire arrows, or use a catapult to lob rocks, at the castle and its inhabitants.

You can block Internet based threats with your firewall, or NAT router, but WiFi will be a danger unless you use both encryption (preventing malicious eavesdropping of your WiFi traffic), and authentication (preventing injection of malicious WiFi traffic, or access to your servers). WEP is the absolute minimum security that you may use, but I will never recommend anything less than WPA.

▲ Top

Layer 2 - Individual Network Protection
Besides protecting the outer edges of your network, you need to protect its interior components. Interior (individual computer) protection requires a port monitor or a personal firewall.


You need a personal firewall on each computer in your LAN; in case one computer gets infected, a personal firewall on the others could save you a lot of trouble. Note that traditionally, a personal firewall would be software based. Now, there is also the possibility of a hardware firewall, sitting inside your computer. The nVidia nForce is probably the first, but surely not the last, device of this type.

Relying solely upon a personal firewall or a port monitor, to protect you against hostile outgoing network activity, is like relying upon a dentist for protection, and having him fill the cavities in your teeth. Brushing and flossing (here equivalent to the Third Layer) is a so much more pleasant way to spend time, in the long term.

▲ Top

Layer 3 - Software Protection
Perimeter and individual network protection protects you against malicious network traffic. You also need to protect yourself against malicious content. Properly chosen content protection, on each individual computer, complements network based protection. Content protection has many components, to counter the many ways the bad guys will try to take control of your computer. Use as many as possible - better one or two, than none.


▲ Top

Layer 4 - Common Sense
Next, use common sense when installing software, and when using your computer.

The most critical tool, in your defense, is right between your ears. Keep your Chair To Keyboard Interface carefully tuned. If you're playing music, and a EULA pops up, ask why you're seeing a EULA.
▲Top

Layer 5 - Education
Finally, educate yourself. This is a constant activity. Stay informed - Know what the risks are.

▲' Top

Overall Security
My personal philosophy about protection is that you should apply protection repeatedly, until you run out of money, paranoia, system resources, or time.


There are many different opinions on this matter. I think that the resources that I spend preventing a malware infection are a far better investment than dealing with (experiencing, detecting, and removing) an infection that could have been prevented. So protect youself, and the rest of the internet, please. The rest of us, who see the effects of our friends becoming infected, thank you.