Deter, Detect, Delay, Deny and Respond: Understanding Layered Physical Security under GEBSS

One of the most important concepts in the Guidelines for Enhancing Building Security in Singapore (GEBSS) is that effective physical security should not depend on a single protective measure.

A camera can detect an intrusion but cannot physically stop it. A strong door can delay an attacker but provides limited value if nobody knows that the attack is taking place. An alarm can raise an alert but cannot by itself protect the asset if there is no effective response.

GEBSS therefore adopts a Layered Protection Concept, also described as Defence-in-Depth, consisting of five layers:

Deter → Detect → Delay → Deny → Respond

The idea is that several complementary layers of physical, technological and operational protection make a facility harder to penetrate while giving security personnel enough time to identify and respond to an incident.

The central principle is:

Security is not about whether one device works. It is about whether all the layers work together before an attacker can reach the Critical Asset.

What is layered physical security?

Layered physical security means placing several complementary protective measures between a potential threat and the asset being protected.

GEBSS explains that a multi-layered defence is harder to penetrate than a single layer and can provide security forces with additional time to detect and respond to an incident. The layers should combine physical, operational and technological measures to provide coordinated protection of Critical Assets.

A building might therefore use:

a visible perimeter to discourage unauthorised entry, CCTV or intrusion detection to identify an attempt, barriers or resistant doors to slow further movement, access control to restrict entry into protected areas, and security personnel to respond.

No single element performs every function.

What are the five layers under GEBSS?

These functions come directly from the GEBSS layered-protection framework.

What does “Deter” mean?

Deterrence is intended to discourage the adversary from attempting the attack in the first place.

GEBSS describes deterrence as a psychological strategy that communicates that the likelihood of failure or being caught is high.

Examples include visible:

perimeter surveillance, fencing or walls, security lighting, security equipment, warning signs, guards and patrols.

A deterrent therefore does not necessarily physically prevent someone from entering.

Its purpose is to influence behaviour before the intrusion occurs.

Is CCTV a deterrent?

It can contribute to deterrence.

GEBSS specifically identifies visible surveillance technology and signage indicating that an area is monitored as deterrent measures.

However, CCTV can perform other functions as well.

It can assist with:

detection, assessment, monitoring and post-incident investigation.

This illustrates an important point about layered security:

One control can contribute to more than one layer.

Do security guards provide deterrence?

Yes.

GEBSS specifically identifies visible guards and patrols as measures that can support deterrence.

The visible presence of security personnel can communicate that the site is monitored and that an attempted intrusion is more likely to be discovered and challenged.

But guards are not only a deterrence measure.

They may also contribute to:

detection, access control and response.

What does “Detect” mean?

Detection is about discovering that a security event is taking place early enough for action to be taken.

GEBSS says useful detection should provide information such as:

the time of the incident, its location and images of what is occurring.

Detection controls can include:

video analytics, intrusion detection systems, vibration sensors, magnetic contacts, passive infrared motion detectors and access-control systems.

The purpose is:

Identify the event before the attacker reaches the protected asset.

Is CCTV enough for detection?

Not always.

GEBSS specifically mentions dual technology, such as pairing CCTV with an intrusion detection system, as a way to improve the speed and accuracy of incident detection.

For example, an intrusion sensor may generate the initial alarm while CCTV helps the operator understand:

what happened, where it happened and whether the event appears genuine.

The technologies complement each other.

What is the difference between detection and assessment?

GEBSS does not formally present “assessment” as a sixth layer in its five-stage model.

However, detection information should provide enough information for security personnel to understand what is happening and respond appropriately.

Consultant’s perspective

Operationally, it is useful to distinguish:

Detection: Something happened.

from

Assessment: What actually happened?

For example:

A perimeter alarm may indicate movement.

The associated camera may help determine whether the cause is an intruder, contractor, animal or false activation.

Assessment therefore helps convert an alarm into a security decision.

This is an implementation interpretation, not an additional GEBSS layer.

What does “Delay” mean?

Delay is intended to slow down the attacker.

GEBSS says obstacles should buy sufficient time for an appropriate response and make it harder for the attacker to penetrate further into the facility.

Examples identified by GEBSS include:

intrusion-resistant doors, physical barriers, access-control measures and the ability to lock down parts of the building.

Delay is therefore fundamentally about time.

Why is delay so important?

Because detection without delay may not provide enough time for intervention.

Imagine that an alarm identifies an attacker immediately, but the attacker can reach the protected asset in 15 seconds.

If the security response takes several minutes, detection alone has not protected the asset.

The delay layer is intended to increase the amount of time available between:

Detection of the attack

and

Compromise of the asset.

GEBSS expressly says delay measures are intended to buy time for an appropriate response.

Is a security door mainly a “Deny” control or a “Delay” control?

It can contribute to both.

A locked door may deny normal unauthorised access.

If someone attempts to physically defeat it, its construction may also delay forced entry.

The important point is not necessarily to assign every device to only one category.

The layered model helps the designer understand what security function the control is expected to perform.

Can access control provide delay?

Yes.

GEBSS specifically includes access-control measures within its description of delay.

For example, multiple controlled security zones can make it more difficult for an intruder who has crossed the outer boundary to move directly to a Critical Asset.

This is one reason internal security zoning can be important.

What does lockdown have to do with delay?

GEBSS identifies the ability to lock down specific areas of a building as one way of limiting an attacker’s movement.

The purpose is not necessarily to make the entire building inaccessible.

The security system may instead restrict movement through selected layers or zones to prevent an attacker from moving deeper into the facility.

Any lockdown arrangement must also be designed consistently with applicable life-safety and emergency requirements.

What does “Deny” mean?

Deny means ensuring that only authorised people can enter protected areas.

GEBSS identifies access-control measures as a primary means of verifying identity.

Examples include:

card access, biometric access and security personnel controlling entry points.

GEBSS also says creating separate security zones can limit exposure even if an intruder succeeds in entering one part of the building.

Is “Deny” the same as “Delay”?

No, although one control can contribute to both.

Deny is about preventing unauthorised access.

Delay assumes an attempt is being made to overcome the protection and asks:

How long can we slow the attacker down?

For example, a card-controlled door denies access to someone without the correct credential.

If the person then tries to physically force the door open, the strength of the door, frame, lock and surrounding wall contributes to delay.

Does GEBSS require biometrics?

No universal requirement for biometrics should be inferred from the layered-protection section.

GEBSS lists biometric and card access as examples of methods that can support the Deny layer.

The wider GEBSS approach remains risk-based.

The appropriate authentication method should therefore be selected according to:

the protected area, Critical Asset and required security level.

What is security zoning?

Security zoning means dividing the building into areas with different access requirements rather than treating the entire building as one security space.

GEBSS says separate zones can limit exposure if an intruder manages to enter one part of the building.

Consultant’s perspective

A simple building might conceptually have:

public space, controlled employee space, restricted operational space and Critical Asset areas.

The exact zoning structure should follow the building’s operations and risk assessment.

The benefit is that compromising one layer does not automatically provide access to everything behind it.

What does “Respond” mean?

Response is the action taken after an intrusion or attack has been identified.

GEBSS gives examples including:

turning on lights, sounding sirens, focusing surveillance cameras on the intrusion point and deploying security personnel.

Most importantly, GEBSS states that response must be integrated with detection and delay if it is to be effective and timely.

This is perhaps the most important relationship in the entire layered model.

Why must detection, delay and response be integrated?

Because each one depends on the others.

Detection answers:

Do we know an incident is happening?

Delay answers:

Can we prevent the attacker from immediately reaching the asset?

Response answers:

Can someone take effective action before the protection is defeated?

If any one of these is missing, the system can become ineffective.

A very strong barrier with no detection may eventually be defeated without anyone knowing.

Excellent detection with no delay may identify the attack but provide no time to stop it.

Strong detection and barriers with no response may simply document the eventual breach.

Is response always a security guard?

Not necessarily.

GEBSS gives security personnel deployment as one response measure but also mentions actions such as:

lighting, sirens and camera focus.

The appropriate response depends on the incident and the building’s security arrangements.

Consultant’s perspective

Response can be thought of in layers as well.

An initial automated response may trigger an alarm and bring relevant cameras to the operator’s attention.

The operator may then communicate with on-site personnel or escalate according to the established security procedure.

GEBSS does not prescribe one universal response workflow for every building.

Can remote monitoring be part of the Response layer?

The layered-protection section does not specifically prescribe a remote-monitoring model.

However, the principle remains the same:

detection information must reach someone capable of initiating an appropriate response.

Whether that person is located:

in the building’s Security Control Room or in another monitoring location

depends on the building’s security arrangement.

The key requirement from the layered concept is that the response is effective and timely.

How does the Security Control Room fit into layered protection?

The Security Control Room can support several layers simultaneously.

GEBSS elsewhere describes it as the building’s nerve centre of security operations, receiving and providing information between security personnel, management and first responders.

From a layered-security perspective, the SCR can help:

receive detection events, assess alarms, monitor attempts to overcome delay measures, manage security systems and coordinate response.

It is therefore part of the operational connection between technology and human action.

Where does the perimeter fit?

The perimeter normally represents one of the outer security layers.

It can contribute to:

Deter: visible fencing, barriers, surveillance and lighting.

Detect: perimeter intrusion sensors and cameras.

Delay: fences, walls and physical barriers.

Deny: controlled vehicle and pedestrian entry.

Respond: security posts, monitoring and security deployment.

This illustrates how a properly designed perimeter can support the entire layered-security model rather than simply marking the property boundary.

How would layered security work at a vehicle entrance?

Consider a protected vehicle entrance.

Deterrence may come from visible security officers, barriers, cameras and signage.

Detection may involve observation, surveillance or screening.

Delay may come from road geometry, gates or vehicle security barriers.

Deny is achieved by preventing an unauthorised vehicle from proceeding into the site.

Response could involve keeping the barrier closed, directing the vehicle away, alerting the control room or deploying security personnel depending on the situation.

This is a consultant’s example applying the GEBSS framework rather than a prescribed GEBSS sequence.

How would layered security work at a Critical Asset room?

Consider a Critical Asset such as a server room.

An outer controlled office may provide the first layer.

CCTV and access-event monitoring may help detect unusual activity.

The room’s wall, door and lock can provide delay.

Access control can deny entry to unauthorised employees.

An intrusion alarm can alert security if the boundary is breached.

Security personnel or another defined response can then act.

Again, the objective is:

Do not allow compromise of the Critical Asset simply because one security layer fails.

What happens if an attacker has a valid access card?

This is precisely why layered protection should not rely entirely on one authentication device.

A credential can support the Deny layer, but GEBSS’s overall framework incorporates:

physical barriers, surveillance, intrusion detection, zoning, operational controls and response.

Consultant’s perspective

For more sensitive areas, the risk assessment may justify additional layers such as:

stronger authentication, monitoring, logging, intrusion detection or more restrictive zoning.

The exact measures should follow the Risk Assessment rather than assuming one universal configuration.

Is more security always better?

Not necessarily.

GEBSS is explicitly risk-based and does not assume maximum protection is required for every building or area.

Layered protection should therefore be proportionate.

A low-risk general office area does not necessarily need the same combination of barriers, authentication and intrusion detection as:

a Security Control Room, data centre or other Critical Asset.

The purpose of the Risk Assessment is to establish where the stronger layers are justified.

Does every layer need separate equipment?

No.

A single measure can support multiple security functions.

For example:

This table is an interpretation of the functions described in the GEBSS layered-protection section. It is not a classification table published in GEBSS.

Should security technologies be integrated?

The GEBSS layered-protection concept clearly encourages complementary operation between technologies.

It specifically gives the example of pairing CCTV with intrusion detection as dual technology, which can improve timely and accurate detection.

This does not necessarily mean every system has to be integrated into one software platform.

The more important functional question is:

Does information move quickly enough between the relevant systems and people to support an effective response?

What is the biggest mistake with layered security?

One of the biggest mistakes is treating a collection of security products as though it automatically creates layers.

A building could have:

20 cameras, 50 card readers, several alarms and numerous guards

but still have weak layered protection if those controls are deployed without reference to the threat and Critical Asset.

Consultant’s perspective

A useful design should trace the likely path of an attacker:

Where could they approach? Where would they first be detected? What would slow them down? What prevents further access? Who receives the alarm? What happens next?

That turns the GEBSS philosophy into an operational security design.

What is the relationship between layered protection and the Risk Assessment?

Layered protection should follow the Risk Assessment.

GEBSS says building owners should first work through threat scenarios, assess vulnerabilities and consequences, and then implement mitigation to address the identified risk.

The Risk Assessment determines:

where stronger protection is needed.

The layered-protection concept helps determine:

how that protection should work.

The two should therefore be used together.

Can layered protection reduce consequences even if an attack is not prevented?

Yes.

Some security measures are intended to prevent or disrupt an attack.

Others reduce its consequences.

For example, GEBSS’s Risk Assessment section explains that measures such as protected glazing may not prevent an explosive event but can reduce injuries caused by glass fragmentation.

Layered protection therefore should not be understood solely as:

stopping an attacker at the front gate.

It can also include measures that limit the impact when prevention fails.

How should a building owner assess whether the layers are good enough?

The building owner should return to the Risk Assessment.

For each credible threat scenario, the organisation can consider whether the existing layers provide enough:

deterrence, early detection, physical delay, access denial and timely response

to reduce the risk to an acceptable level.

Where a gap exists, the mitigation should address that specific weakness rather than automatically adding more technology.

A practical Layered Security Review

A building owner or project team can review each important asset using one simple structure:

The most important follow-up question is:

What happens if one of these layers fails?

That is the practical value of Defence-in-Depth.

Common misunderstandings about Deter, Detect, Delay, Deny and Respond

“Every layer needs a different system.”
No. Individual controls can contribute to several security functions.

“CCTV provides all five layers.”
No. CCTV can assist deterrence, detection and response, but it does not itself provide significant physical delay or denial.

“A strong door means the room is secure.”
Not necessarily. There must also be a means of detecting an attempted breach and responding before the barrier is defeated.

“Access control and denial are the same thing.”
Access control supports denial, but the Deny layer can also involve security personnel, zoning and other measures.

“Once an intruder enters the building, the security system has failed.”
Not necessarily. Defence-in-Depth assumes individual layers can be breached. Internal zoning and additional controls are intended to prevent one breach from exposing all Critical Assets.

“The purpose of delay is to stop the attacker permanently.”
Not necessarily. Its primary role is to slow progress sufficiently to allow an appropriate response.

“If an alarm activates, the security system worked.”
Only partly. GEBSS specifically links response with detection and delay. An alarm without timely action does not complete the protective chain.

Conclusion

The GEBSS layered-protection concept is best understood as a security chain rather than a collection of security products.

The five layers are:

Deter → Detect → Delay → Deny → Respond.

GEBSS says these layers should complement one another through physical, operational and technological measures so that Critical Assets receive coordinated protection.

Deterrence attempts to discourage the attack.

Detection identifies it early.

Delay creates time.

Denial restricts access to protected areas.

Response converts the warning and available time into action.

The most important design question is therefore not:

“Do we have CCTV, access control and alarms?”

It is:

“If an attack begins, will we detect it early enough, slow it down long enough, keep it away from the Critical Asset, and respond before the protection is overcome?”