What Is Defense In Depth?

Defense in depth is a strategy that leverages multiple security measures to protect an organization's assets. The thinking is that if one line of defense is compromised, additional layers exist as a backup to ensure that threats are stopped along the way. Defense in depth addresses the security vulnerabilities inherent not only with hardware and software but also with people, as negligence or human error are often the cause of a security breach. 

Today’s cyber threats are growing rapidly in scale and sophistication. Defense in depth is a comprehensive approach that employs a combination of advanced security tools to protect an organization's endpoints, data, applications, and networks. The goal is to stop cyber threats before they happen, but a solid defense-in-depth strategy also thwarts an attack that is already underway, preventing additional damage from taking place. 

Antivirus software, firewalls, secure gateways, and virtual private networks (VPNs) serve as traditional corporate network defenses and are certainly still instrumental in a defense-in-depth strategy. However, more sophisticated measures, such as the use of machine learning (ML) to detect anomalies in the behavior of employees and endpoints, are now being used to build the strongest and most complete defense possible.  

Defense in depth is needed now more than ever as more employees work from home and as organizations increasingly rely on cloud-based services. With employees working from home, organizations must address the security risks associated with employees using their own devices for work and their home Wi-Fi connection to enter the corporate network. 

Even with IT resources in place, vulnerabilities are inherent in devices used for both work and personal use—vulnerabilities exploited by cyber criminals. Further, with more companies using cloud-hosted, Software-as-a-Service (SaaS) applications, many of which are mission-critical, the privacy and security of an increasing amount of data entered through websites remain difficult to manage.

The concept of defense in depth is no different from physical security, such as that used for a building or to start work in an office environment. Building security has many layers, some of which may be considered redundant: 

1. An employee uses a key card to enter the building. 
2. A security guard keeps watch in the lobby.
3. Security cameras record all movements in the lobby, on each floor, and in the elevator.
4. Once arriving at her floor, an employee must use her key card to open the door to the office floor.
5. Once at her desk, the employee turns on her computer and enters her password and temporary four-digit code (two-factor authentication) to log in to the company network.

These are, of course, just a handful of security steps that the employee must take to begin work for the day. Some of these may seem unnecessary and some measures may seem stronger than others, but taken together, they are analogous to a defense-in-depth strategy in place within organizations.

The following are some common issues organizations have to deal with when implementing a cybersecurity strategy:

1. Anti-malware software has not been updated or is not installed on all devices.
2. Employees have not been trained and are falling victim to phishing schemes.
3. Software patches are not being updated or are ignored.
4. Security policies are not enforced or even known by employees.
5. Missing or poorly implemented encryption.
6. Remote employees are connecting to unsecured networks, such as the public internet.
7. Physical security flaws, such as unsecured server rooms.
8. Business partners, such as cloud service providers, are not fully secure.

Imagine all of these issues taking place at once. The only way for an enterprise to defend itself from vulnerabilities is with a solid, comprehensive defense-in-depth strategy. If one measure fails, another measure is on standby ready to take action.