Concentric Circles of Protection

An underlying principal for providing good security involves a concept called “Concentric Circles of Protection”, sometimes also called "Security in Depth". This concept involves the use of multiple “rings” or “layers” of security. The first layer is located at the boundary of the site, and additional layers are provided as you move inward through the building toward the high-value assets.

Rather than placing full reliance on a single layer of defense, these layers require an intruder to penetrate a series of layers to reach his goal. The more layers that exist between the outside world and a high-value asset, the better the security. The Concentric Circles of Protection concept is similar to the “multiple lines of defense” strategy employed by many military planners.

This concept is illustrated in the diagram below. Please note that at the boundaries of each layer, those people who belong within the next layer can be separated from those who don’t belong. Also, at each boundary, there is an opportunity to deter, detect, and delay an intruder. This allows intruders attempting to penetrate the layer to be detected and intercepted with an appropriate security response.

The logic behind having multiple layers of security is simple: having multiple layers eliminates total reliance on any single layer and provides redundancy. For example, in the diagram above, an intruder who “tailgated” through an exterior door would need to breech two additional layers of security before he could reach the high-value asset. While the chances of breeching any single layer may be good, the chance of breeching three or more successive layers becomes exponentially more difficult.

The multiple layers concept also provides redundancy in case there is a breakdown in procedures. For example, an employee may fail to lock a valuable piece of equipment in a cabinet as per established procedures, but instead leaves the equipment lying out openly on a desk. If the employee’s office is locked, and access to the department is controlled, the equipment is still protected.

Conversely, if a janitor were to inadvertently leave an individual office door unlocked while cleaning, the valuable equipment would still be afforded some protection by the locked door that controls access into the department, and the secured cabinet in the office where the equipment is stored. Again, while the chance of a breakdown in any single procedure may be good, the chance of a breakdown in three or more successive procedures is considerably less likely.

An absolute minimum of three layers should exist between the outside world and any type of high-value asset; with five or more layers being desirable.

Basic Principals of Security Layers

Having multiple layers decreases the probability that the intruder will be able to gain access.

You can decrease the intruder’s chance of success by adding layers, or by increasing the effectiveness of each layer, or by doing both.

Relying on a single layer to provide security is almost never effective because it requires a level of perfection that is unattainable.

Simple procedures, such as the locking of file cabinets and offices, can provide additional security “layers” at little or no cost.

Employee security awareness can create an invisible, yet very effective, security “layer”.

Have additional questions about concentric circles of protection? Please contact us.

Like this article?

Visit our Security Tips page for more than 75 additional articles on a variety of topics related to physical security

Did You Know?

Silva Consultants is an independent security consulting firm and does not sell security equipment or products

Need Help?

Silva Consultants can assist you in the design and planning of an effective security program and in the selection of security products and services

Please contact us for further assistance

Thinking about becoming an independent security consultant yourself?

Buy Michael A. Silva's book on Amazon

"Becoming an Independent Security Consultant – A Practical Guide to Starting and Running a Successful Security Consulting Practice"

Published May, 2016