What must stay in working memory
- Trace a realistic attack path and ask what still protects the asset after each control fails.
- Layers should reduce different parts of likelihood or impact and should avoid a shared failure mode.
- Recovery copies need separation from the identities and systems that an attacker can compromise in production.
Concrete examples
- MFA, resource authorization, segmentation, and session monitoring constrain different stages of account misuse.
- An offline or immutable recovery copy survives credentials that can delete ordinary online backups.
Decision rules you’ll retrieve
Find the missing independent layer
Follow the stated failure path to the protected asset and choose a layer that still works after the existing safeguard is bypassed or compromised.
Retrieval cue: Given one failed control, explain how you would identify an independent layer that protects the same asset without sharing the failure mode.