Security in Layers

The first thing to understand is that security is not defined in absolutes. There is no such thing as a perfectly secure computer system. It is often said that the most secure computer is one that is turned off. How useful is that? Even still, is it secure against a hammer or a cruise missile? Protecting a wireless network is like protecting a car. You can put The Club on your steering wheel. You can even hire a 24-hour armed guard. But if somebody out there has enough time and energy, then your assets are at risk. Always keep in mind that security is a task performed in layers. Sometimes it's as simple as turning a feature on or off, but most of the time, security requires delicate balance and judgment.

The number of security layers you will need to implement will depend mostly on what you are trying to protect. Sometimes the cost of adding a security control exceeds the cost of the asset you are trying to protect. Let's expand on the example of protecting a car. Hiring a 24-hour armed guard to protect the car might help prevent it from being stolen, but is the cost of the guard worth it? How much is the cost of car to begin with? Conversely, locking your door at night may not totally stop 100% of all the thieves out there, but if it's “free” and already there (a “built-in” security feature), why not use it?