Defense in depth (computing)
Defense in depth is a concept used in information security in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited.[1]
Background
[edit]The idea behind the defense in depth approach is to defend a system against any particular attack using several independent methods.[2] It is a layering tactic, conceived by the National Security Agency (NSA) as a comprehensive approach to information and electronic security.[3][4]
Defense in depth is sometimes thought of as forming the layers of an onion, with data at the core of the onion, people the next outer layer of the onion[clarification needed], and network security, host-based security, and application security forming the outermost layers of the onion.[5]
Tiers
[edit]Defense in depth can be divided into three overarching areas: Physical, Technical, and Administrative.[6]
Physical
[edit]Physical controls are anything that physically limits or prevents access to IT systems. Examples of physical defensive security are: fences, guards, dogs, and CCTV systems.[3]
Technical
[edit]Technical controls are hardware or software whose purpose is to protect systems and resources. Examples of technical controls include disk encryption, file integrity software, authentication,[7] network security controls, antiviruses, and behavioural analysis software.[8]
In the event that one layer of defence fails, defense in depth aims to ensure network security via a second-line of defence.[3] For example, if an attacker penetrates a computer system at a given OSI layer (e.g. Layer 3), a redundancy should exist at another layer (Layer 7) to ensure layered defense.[3]
- Authentication, authorization, and accounting
- Confidentiality, integrity, and availability
- Authentication and password security
- Encryption
- Hashing
Application security
[edit]Host security
[edit]Network security
[edit]Administrative and operational
[edit]Administrative controls are the organization's policies and procedures and govern the organisation's human resources, technology, and operations.[3]
People
[edit]Technology
[edit]Operations
[edit]See also
[edit]References
[edit]- ↑ "Secure Product Design - OWASP Cheat Sheet Series". cheatsheetseries.owasp.org. Retrieved 2025-10-02.
- ↑ "Security in the Cloud". Schneier on Security. 2006-02-15. Retrieved 2025-10-02.
- 1 2 3 4 5 6 7 8 9 National Security Agency, Defense in Depth: A practical strategy for achieving Information Assurance in today’s highly networked environments.
- ↑ OWASP CheatSheet: Defense in depth
- ↑ "Security Onion Control Scripts". Applied Network Security Monitoring. Elsevier. 2014. pp. 451–456. doi:10.1016/b978-0-12-417208-1.09986-4. ISBN 978-0-12-417208-1. Retrieved 2021-05-29.
- ↑ Stewart, James Michael; Chapple, Mike; Gibson, Darril (2015). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide. John Wiley & Sons. ISBN 978-1-119-04271-6.
- 1 2 3 4 5 6 "What is defense in depth? | Layered security". www.cloudflare.com. Retrieved 2025-10-02.
- ↑ "What is Defense in Depth? Defined and Explained". Fortinet. Retrieved 2025-10-02.
- 1 2 3 4 5 "Cybersecurity Spotlight - Defense in Depth (DiD)". CIS. Retrieved 2025-10-02.