| content |
Contents |
Background
The idea behind the Defense in Depth approach is to defend a system against any particular attack using several, varying methods. It is a layering tactic, conceived by the National Security Agency (NSA) as a comprehensive approach to information and electronic security.1
Defense in depth is originally a military strategy that seeks to delay, rather than prevent, the advance of an attacker by yielding space in order to buy time. The placement of protection mechanisms, procedures and policies is intended to increase the dependability of an IT system where multiple layers of defense prevent espionage and direct attacks against critical systems. In terms of computer network defense, Defense in Depth measures should not only prevent security breaches, but buys an organization time to detect and respond to an attack, thereby reducing and mitigating the impact of a breach.
Examples
Using more than one of the following layers constitutes Defense in Depth.
- Physical Security (e.g. deadbolt locks)
- Authentication and password security
- Antivirus software
- Firewalls (hardware or software)
- DMZ (Demilitarized zones)
- IDS (Intrusion Detection Systems)
- Packet filters
- Routers and Switches
- Proxy servers
- VPN (Virtual private networks)
- Logging and Auditing
- Biometrics
- Timed access control
- Software/hardware not available to the public (but see also Security through obscurity)
References
- ^ Defense in Depth: A practical strategy for achieving Information Assurance in today’s highly networked environments.
See also
