Defense in depth (computing)

Defense in depth is a concept used in Information security in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited that can cover aspects of personnel, procedural, technical and physical security for the duration of the system's life cycle.

For the military strategy, see Defence in depth.

Background

The idea behind the defense in depth approach is to defend a system against any particular attack using several independent methods.[1] It is a layering tactic, conceived. by the National Security Agency (NSA) as a comprehensive approach to information and electronic security.[2][3] The term defense in depth in computing is inspired by a military strategy of the same name, but is quite different in concept. The military strategy revolves around having a weaker perimeter defense and intentionally yielding space to buy time, envelop, and ultimately counter-attack an opponent, whereas the information security strategy simply involves multiple layers of controls, but not intentionally ceding ground (cf. honeypot.)

Controls

Defense in depth can be divided into three areas: Physical, Technical, and Administrative.[4]

Physical controls

Physical controls[2] are anything that physically limits or prevents access to IT systems. Fences, guards, dogs, and CCTV systems and the like.

Technical controls

Technical controls are hardware or software whose purpose is to protect systems and resources. Examples of technical controls would be disk encryption, fingerprint readers, and authentication. Hardware technical controls differ from physical controls in that they prevent access to the contents of a system, but not the physical systems themselves.

Administrative controls

Administrative controls are an organization's policies and procedures. Their purpose is to ensure that there is proper guidance available in regards to security and that regulations are met. They include things such as hiring practices, data handling procedures, and security requirements.

Examples

Using more than one of the following layers constitutes an example of defense in depth.

System/application security:

• Antivirus software
• Authentication and password security
• Encryption
• Hashing passwords
• Logging and auditing
• Multi-factor authentication
• Vulnerability scanners
• Timed access control
• Internet Security Awareness Training
• Sandboxing
• Intrusion detection systems (IDS)

Network security:

• Firewalls (hardware or software)
• Demilitarized zones (DMZ)
• Virtual private network (VPN)

Physical security:

• Biometrics
• Data-centric security
• Physical security (e.g. deadbolt locks)

Practical example: an application is written by security-aware developers in a memory-safe language and then audited. Despite the security measures already listed, the application is also executed in a sandbox.

Furthermore, the hosts running such application are isolated from other critical systems using Firewalls.

See also

• Defence-in-depth (Roman military)
• Defense strategy (computing)

References

1. Schneier on Security: Security in the Cloud
2. Defense in Depth: A practical strategy for achieving Information Assurance in today’s highly networked environments.
3. OWASP Wiki: Defense in depth
4. Stewart, James Michael; Chapple, Mike; Gibson, Darril (2015). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide.