In the cybersecurity onion model, which is the first layer to protect?

In the cybersecurity onion model, which is the first layer to protect?

• A. Perimeter Security
• B. Network and Data Transit Security
• C. Endpoint Security
• D. Physical Security

Answer: (D)

The outermost layer of the onion model is physical security, and it’s the first line of defense because if someone can physically access the hardware, they can bypass all other protections. When an attacker can reach servers, networking gear, or endpoints, they can tamper with devices, steal credentials, install rogue equipment, or simply disrupt power and cooling, rendering software and network controls ineffective. Physical security measures protect the environment where systems live: restricted access to data centers and server rooms, locked cabinets and racks, badge or biometric access, tamper-evident seals, surveillance, proper disposal, and environmental protections like reliable power and cooling. Once physical security is solid, the remaining layers—perimeter controls, security for data in transit, and endpoint defenses—add further barriers that are meaningful only if the hardware itself is secured from the start.

The outermost layer of the onion model is physical security, and it’s the first line of defense because if someone can physically access the hardware, they can bypass all other protections. When an attacker can reach servers, networking gear, or endpoints, they can tamper with devices, steal credentials, install rogue equipment, or simply disrupt power and cooling, rendering software and network controls ineffective. Physical security measures protect the environment where systems live: restricted access to data centers and server rooms, locked cabinets and racks, badge or biometric access, tamper-evident seals, surveillance, proper disposal, and environmental protections like reliable power and cooling. Once physical security is solid, the remaining layers—perimeter controls, security for data in transit, and endpoint defenses—add further barriers that are meaningful only if the hardware itself is secured from the start.