Multi-Layered Systems Security: Firewalls, Encryption, Authentication, and Data Center Protection Strategies

UPI Study › Courses › System Analysis and Design › Free lessons › Lesson 8.6 Free with a free account

Multi-Layered Systems Security: Firewalls, Encryption, Authentication, and Data Center Protection Strategies

System Analysis and Design · Chapter 8: Maintenance, Risk, and SecuritySection 8.6 · lesson 58 of 697 min · free with a free account

← Defending the Network: Security Strategies and TechniquesNext lesson: Tackling Security Challenges in Cloud Computing →

Earn 3 college credits for System Analysis and DesignRecommended for credit by NCCRS · Computer Science 390 · self-paced · one payment, lifetime access
Enroll in System Analysis and Design · $250 →Download the syllabus (PDF)

In this lesson

Defense in depth: firewalls, encryption, authentication, and physical protection.

  • Explain defense in depth as a security strategy
  • Compare packet filtering, stateful, NGFW, and WAF firewalls
  • Distinguish symmetric and asymmetric encryption, at rest and in transit, and hashing
  • Compare MFA, SSO, and biometrics, and describe data center protection

Transcript

Everything said in the video, section by section (924 words). Read along, or search it.

Maintenance, Risk, and Security

Multi-Layered Systems Security

Any single security control can fail. So well-defended systems never rely on just one. This section explains that strategy, defense in depth, and then looks at four of its layers. Firewalls, encryption, authentication, and the physical protection of data centers.

Figure 8.2

Defense in Depth

Defense in depth is a strategy that layers multiple, independent controls around what needs protecting. If one layer fails, or is bypassed, the layers behind it still hold. No single control, however strong, is trusted to protect an asset on its own. Picture it as layers wrapped around the asset. Physical security on the outside. Then the network, with its firewalls. Then the host, and the application. And closest to the asset itself, the data layer, protected by encryption. The rest of this section looks at four of these layers in turn.

The Network Layer

4 Types of Firewall

A firewall controls traffic crossing a boundary. But different types inspect that traffic with very different sophistication. A packet filtering firewall checks individual packets against static rules, such as I P address, port, and protocol. It suits basic perimeter filtering. A stateful firewall tracks the state and context of active connections, not just isolated packets. A next-generation firewall, or N G F W, adds application awareness, intrusion prevention, and threat intelligence, for comprehensive network protection. And a web application firewall, or W A F, inspects the H T T P traffic to and from one specific web application. That distinction matters. A stateful firewall, however well configured, reasons about connections and packets. It has no view into the content of a web request. An attack hidden inside an otherwise valid request, such as a SQL injection attempt, typically needs a W A F to catch it.

The Data Layer

Symmetric vs. Asymmetric Encryption

At the data layer, the main tool is encryption, and it comes in two forms. Symmetric encryption uses one shared key, both to encrypt and to decrypt. It is fast, and efficient for large volumes of data. But the key has to be shared securely, beforehand. Asymmetric encryption uses a mathematically linked pair of keys, one public and one private. Data encrypted with the public key can only be decrypted with the matching private key. That solves the key-sharing problem, because the public key can be shared openly. But it is slower, and more demanding to compute. So in practice, asymmetric encryption is often used to exchange a symmetric key securely, and for digital signatures. Symmetric encryption then does the heavy lifting on large volumes of data.

Data States

At Rest, In Transit - and Hashing

Encryption is also described by the state the data is in. Encryption at rest protects stored data, such as an encrypted database file. Encryption in transit protects data moving across a network, such as T L S protecting a web session. Hashing is related, but different. A hash is a one-way function. It turns data into a fixed-length value that cannot be reversed back into the original. It is used to verify integrity, or to store a password without storing the password itself. Encryption, by contrast, is reversible by design. A key converts the data back to its original form. That is why hashing is used for integrity and password storage, not for protecting confidentiality.

Who Reaches Any Layer

MFA, SSO, and Biometrics

Authentication controls who reaches any layer at all. Multi-factor authentication, or M F A, requires two or more independent factors. Something the user knows, something they have, and something they are. Its benefit is that a single compromised credential is no longer enough. So if a stolen password alone should never unlock an account, M F A is the direct answer. Single sign-on, or S S O, lets a user authenticate once, and reach several connected systems without entering credentials again. It reduces password fatigue. And biometrics use a measurable physical or behavioral trait, such as a fingerprint or a face, as a factor. They are hard to steal or guess remotely, though they carry their own risks if they are ever compromised.

The Outermost Layer

Protecting the Data Center Physically

Physical security is the outermost layer, and for good reason. No amount of network, host, or application security matters if someone can simply walk up to the hardware. Perimeter security, fencing and barriers, keeps unauthorized people from approaching the facility. Access control, with badges, biometric locks, and mantraps, ensures only authorized personnel physically enter. Surveillance, through C C T V, monitors and records activity. Environmental controls, such as fire suppression, climate control, and redundant power, protect the equipment itself. And redundancy, with backup generators and multiple network paths, keeps the data center available if one component fails. That last measure is availability, from the C I A triad, in physical form.

Key Terms

The Vocabulary of This Section

Let's lock in the key terms. Defense in depth layers independent controls around an asset. A next-generation firewall adds application awareness. A web application firewall protects one web application. Symmetric encryption uses one shared key. Asymmetric encryption uses a public and private key pair. Hashing is a one-way transformation, used for integrity and password storage. And M F A requires two or more factors, while S S O gives one login for many systems.

Key Takeaways

What to Carry Forward

To pull this together. Defense in depth layers independent controls, so one failed layer does not leave the asset unprotected. Packet filtering and stateful firewalls inspect network traffic. Next-generation firewalls add application awareness. And a W A F catches application-layer attacks a network firewall cannot see. Symmetric encryption is fast but needs a shared key. Asymmetric encryption solves key sharing at the cost of speed. Hashing is one-way. M F A, S S O, and biometrics each strengthen or streamline authentication in different ways. And physical protection is the outermost layer, where redundancy directly supports availability.

About System Analysis and Design at UPI Study

System Analysis and Design (Computer Science 390) is a self-paced online course of 69 video lessons in 9 chapters, from the analyst's role and requirements to UML modeling, interface and database design, testing, maintenance and project management. It carries a NCCRS credit recommendation for 3 semester credits.

Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Enroll now → Course details Download the syllabus All Computer Science courses Every course with PRO →

Compare: Software Engineering vs Systems Analysis

Why take it here

Why students take System Analysis and Design with UPI Study

From business problem to working systemSystem Analysis and Design teaches how analysts study a business need and turn it into a system design: requirements, UML and data-flow models, interface and database design, implementation and project management. It is a core course in information systems and IT degrees.
Credit at a fraction of the priceThe same 3 credits can cost $750 or more at a US college. Here it is one payment, self-paced, with lifetime access.
Finish your degree soonerTransfer credits reduce the courses you still owe, so you can graduate earlier or lighten a heavy semester.
Strengthen an applicationA completed college-level course on an official transcript shows admissions and scholarship committees you can do the work.
Study on your own scheduleNo start dates, no deadlines. Watch the lessons, practice, and take the final when you are ready.
130,000+students helped with college creditsACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Where the credit goes

Universities that work with NCCRS

System Analysis and Design carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.

Thomas Edison State UniversityThomas Edison State UniversitySigned partnerUniversity of the PeopleUniversity of the PeopleSigned partnerCharter Oak State CollegeCharter Oak State CollegeSigned partnerStrayer UniversityStrayer UniversitySigned partnerColumbia Southern UniversityColumbia Southern UniversitySigned partnerIndiana TechIndiana TechSigned partnerPenn StatePenn StateWorks with NCCRSSouthern New Hampshire UniversitySouthern New Hampshire UniversityWorks with NCCRSSUNYSUNYWorks with NCCRS +many more cooperating universitiesFind my college →

Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.

FAQ

Questions students ask us

About Multi-Layered Systems Security: Firewalls, Encryption, Authentication, and Data Center Protection Strategies

What is defense in depth in cybersecurity?
Defense in depth is a strategy that layers multiple independent security controls around an asset, so if one layer fails or is bypassed, the layers behind it still protect it. No single control is trusted to do the job alone. Typical layers run from physical security on the outside, through the network and its firewalls, the host, and the application, to encryption at the data layer.
What is the difference between a stateful firewall and a web application firewall?
A stateful firewall tracks the state and context of network connections, while a web application firewall, or WAF, inspects the HTTP traffic to and from one specific web application. A stateful firewall reasons about packets and connections and cannot see the content of a web request. An attack hidden inside an otherwise valid request, such as a SQL injection attempt, typically needs a WAF to catch it.
What is the difference between symmetric and asymmetric encryption?
Symmetric encryption uses one shared key to encrypt and decrypt, while asymmetric encryption uses a linked pair of public and private keys. Symmetric encryption is fast and efficient for large data volumes, but the key must be shared securely beforehand. Asymmetric encryption solves key sharing but is slower, so it is often used to exchange a symmetric key and for digital signatures.
What is the difference between hashing and encryption?
Hashing is a one-way function that turns data into a fixed-length value that cannot be reversed, while encryption is reversible with the right key. That is why hashing is used to verify integrity and to store passwords without keeping the passwords themselves, whereas encryption protects confidentiality, both for data at rest, such as a database file, and data in transit, such as a TLS-protected web session.

About the System Analysis and Design course

How many college credits is System Analysis and Design?
System Analysis and Design (Computer Science 390) carries a NCCRS credit recommendation for 3 semester credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
How much does System Analysis and Design cost and what is included?
$250, paid once, with lifetime access: all 69 video lessons, a practice quiz after each, the graded work and final exam, and an official transcript when you finish. Students who want several courses choose UPI Study PRO instead.
Which universities accept UPI Study credits?
UPI Study has signed partner agreements with universities such as Thomas Edison State University, University of the People and Charter Oak State College, and works with universities such as Penn State, SNHU and SUNY. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities. Use "Find my college" on this page to check yours.
How long does System Analysis and Design take?
It is self-paced with no deadlines. The 69 lessons total about 9 hours of video; most students add reading and practice time and finish in a few weeks to a few months, on their own schedule.
How are the exams done?
Quizzes and assignments are online in the course. The final exam is taken online with proctoring; a person on the UPI Study team checks assignments, usually within two days.
How do my credits reach my college?
When the course shows 100% complete, request the official transcript from your dashboard. It is sent to the college you name, and you can send it to more than one. Check your college first with "Find my college" on this page, or ask Athena.

Ready for the full course? Earn 3 credits in System Analysis and Design.

69 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.

Enroll in System Analysis and Design →Download the syllabusEvery course with PRO →
System Analysis and Design
3 credits · NCCRSEnroll →