When an organisation chooses to treat risk, an integrated defence-in-depth concept uses five distinct security capabilities — the Five Ds: Deter, Detect, Delay, Deny and Defeat. The model comes from physical and military perimeter security and applies equally to cyber protection of Industrial Automation and Control Systems (IACS).
Use the Five Ds to build a multi-faceted physical and cyber strategy for each zone and conduit, sized to risk-assessment results, Target Security Level (SL-T) and the Cybersecurity Requirements Specification (CRS). Harmonise physical and cyber policies (Part 2-1 ORG 3) so the layers reinforce each other.
Related layered-architecture teaching: Defence in Depth and Detection in Depth.
| D | Objective |
|---|---|
| Deter | Discourage the attacker from attempting a breach. |
| Detect | Identify unauthorised intrusion in time to respond. |
| Delay | Slow an active intrusion enough for response or abandonment. |
| Deny | Keep unauthorised users or software out while allowing authorised entry. |
| Defeat | Eradicate the intruder or malware, restore normal operation, and retain forensic evidence. |
In perimeter security, the Five Ds form nested rings around the asset: visible fencing and surveillance deter; cameras and sensors detect; barriers delay; access control denies unauthorised entry; security response and law enforcement defeat the intruder. The same sequence guides cyber countermeasure selection.
Make clear that the system will be defended and that intruders will be pursued. Strategies and tools include policies and procedures, warning banners, and obscurity of sensitive details where appropriate.
Monitor systems so unauthorised activity is found in time. Common tools and practices:
See also Detection in Depth.
Slow an active intrusion. Strategies include security hardening, patching, encryption, network segmentation, access controls, and honeypot systems that lure and study attackers.
Keep unauthorised users or software out while allowing authorised use. Common tools: firewalls, application / executable whitelisting, intrusion prevention systems (IPS), and strong access controls.
Respond to eradicate the intruder or malicious software and restore normal conditions; retain forensic evidence for investigation. Common strategies: malware removal tools, incident-response policies and procedures, and intrusion prevention / containment actions.
Build a 5D strategy map for each zone and conduit (and for each significant access point). List threats in the left-hand column, then fill potential mitigations under each D — ask “How can we deter? Detect? Delay? Deny? Defeat?” Aim for at least one treatment under each D where risk and SL-T justify it, so the protection strategy is multi-faceted rather than a single control.
The worked example below uses the threat of unauthorised remote access. The same layout is the working tool in zone and conduit security strategy.
| Threat | Deter | Detect | Delay | Deny | Defeat |
|---|---|---|---|---|---|
| Unauthorised remote access | Warning banner on remote login; policies stating prosecution of intruders | Host intrusion detection (HIDS); event / authentication logs; SIEM alerts | Security hardening of jump hosts; patching; encryption; session / access controls | Firewall rules; VPN with allow-lists; least-privilege access; IPS | Incident-response procedures; revoke sessions / isolate hosts; preserve forensic evidence |
| Malware introduction | Acceptable-use and media policies; warning banners | Anti-virus; IDS; email / URL filtering; SIEM | Patching; hardening; network segmentation; honeypot | Application whitelisting; firewall; removable-media controls | Malware removal tools; IR playbooks; containment via IPS |
Add further threat rows from the risk assessment (for example unauthorised physical access, insider misuse, or denial of service) until each high-risk path for that zone or conduit has a 5D line. Risk-management choice of treat vs other options: Four Ts of Managing Risk.
The Five Ds turn “treat the risk” into a balanced physical and cyber control set. Pair them with Defence in Depth architecture and Part 3-2 / 3-3 design targets so each zone and conduit has layered deterrence, detection, delay, denial and response — not a single perimeter control.