Defense in Depth (computing)
Defense in depth is a layered security strategy for IT systems that deploys multiple, diverse controls to reduce risk, slow attackers, and limit the impact of successful breaches.
Defense in depth is a cybersecurity strategy that arranges several different defensive measures across an information system so that no single failure results in a catastrophic breach. Rather than relying on one dominant control, the approach places overlapping safeguards at different layers — for example at the network boundary, the host, the application, and the data level — so that an adversary must defeat multiple, heterogeneous protections to achieve their objective.
Core principles and components
Key ideas behind defense in depth include redundancy, diversity, and compartmentalization. Redundancy means multiple protections can cover similar risks; diversity means those protections are implemented with different technologies or methods; compartmentalization reduces blast radius by isolating systems and privileges. Typical components include physical security, perimeter defenses, firewalls and network segmentation, endpoint protection, application hardening, access controls and identity management, monitoring and logging, and incident response.
Typical layers and examples
- Perimeter: firewalls, intrusion prevention, VPNs
- Network: segmentation, secure routing, microsegmentation
- Host and endpoint: anti-malware, patch management, configuration baselines
- Application: input validation, secure coding, runtime protection
- Data and identity: encryption, access controls, key management
- Detection and response: logging, SIEM, threat hunting, incident playbooks
Implementations often reference security controls that are applied across an information technology environment. Defenses aim to address different attack vectors so weaknesses in one control do not expose the whole system.
History and development
The idea traces to military doctrine of layered defense and evolved in computing as threats and system complexity grew. Early network-centric models emphasized perimeter protection; modern practice accepts that perimeters can be bypassed and adds stronger internal controls, continuous monitoring, and zero trust principles to reduce reliance on a single boundary.
Benefits and trade-offs
Defense in depth reduces single points of failure and increases attacker cost and time, improving overall resilience. Trade-offs include greater operational complexity, potential performance overhead, and the need for thorough coordination so layers complement rather than duplicate or conflict with one another. Effective deployment balances prevention, detection and response, and is guided by risk assessment and the value of protected assets.
Questions and answers
Q: What is Defense in Depth in computing?
A: Defense in Depth is a concept of information assurance in which multiple layers of security controls are placed throughout an IT system to protect against security attacks.
Q: What is the purpose of Defense in Depth?
A: The purpose of Defense in Depth is to increase the overall security of an IT system by using multiple layers of different security tools to protect against different types of security attacks.
Q: How many layers of security controls are there in Defense in Depth?
A: Defense in Depth uses multiple layers of security controls to increase the security of an IT system.
Q: Are all layers of security controls the same in Defense in Depth?
A: No, all layers of security controls in Defense in Depth are not the same. It uses several different kinds of security controls with each protecting against a different security attack.
Q: What are other names for Defense in Depth?
A: Defense in Depth is also known as layered security and layered defense.
Q: Is Defense in Depth used only for a specific type of IT system?
A: No, Defense in Depth can be used for any type of IT system to increase its overall security.
Q: What does IA stand for in the context of Defense in Depth?
A: IA stands for information assurance in the context of Defense in Depth.
Related articles
Author
AlegsaOnline.com Defense in Depth (computing) Leandro Alegsa
URL: https://en.alegsaonline.com/art/26260
Sources
- techrepublic.com : "Understanding layered security and defense in depth"
- nsa.gov : Defense in Depth: A practical strategy for achieving Information Assurance in today’s highly networked environments.
- wib.org : "Back to Basics – Defense in Depth"
- securestate.com : "Unraveling the Onion: A New Take on Defense-in-Depth"
- sans.org : "The Industrial Control System Cyber Kill Chain"
- darkreading.com : "How Lockheed Martin's 'Kill Chain' Stopped SecurID Attack"