Introduction
When discussing cybersecurity, the comparison to building a fortress is common. In the case of the fortress, while having a solid door is good, the door cannot be used to defend the entirety of the fortress. The same is true of any facility; to be fully secure, it would need walls, surveillance cameras, security measures, alarms, guards, and even emergency procedures.
Just like with any other building, a modern enterprise will have many security problems, such as phishing attacks, ransomware, malware, identity theft, insider threats, software vulnerabilities, supply chain issues, and social engineering. No one method of security will be able to defend against all the threats.
That is why cybersecurity experts use a strategy called Defense in Depth.
Defense in Depth is the cybersecurity strategy which makes use of multiple layers of security controls to make sure that in case one layer fails, there will be other layers to deal with the threat.
What Is Defense in Depth?
The concept of Defense in Depth is a multi-layered strategy for security.
Rather than relying on a single security measure, the organization utilizes a number of security measures that complement each other.
For instance, securing an application used by the corporation would include the following sequence:
User Authentication -> multi-factor authentication -> Device security -> Network Security -> Application Security -> Data Encryption -> Monitoring -> Response
In case the attacker succeeds in breaching one security barrier, he faces another barrier.
This strategy forms security walls between the attacker and the most critical assets of the company.
Why Is One Security Layer Not Enough?
Consider that an organization depends completely on a firewall to protect its network.
The firewall might successfully prevent many unauthorized accesses. But what if:
- The employee clicks on a malicious phishing link?
- The attacker hacks into the computer using the password of a legitimate employee?
- Is there a vulnerability within the application that has been permitted by the firewall?
- Malicious software is downloaded through a legitimate third-party service?
- The employee within the organization uses his/her authorization inappropriately?
In all such scenarios, the firewall might not work to prevent these attacks.
This is an example of a basic rule of cybersecurity:
- Every security measure has weaknesses.
- The firewall could fail.
- The password might get hacked.
- The antivirus software might miss malware.
- The employee could make an error.
- The system has vulnerabilities that have gone unnoticed.
The Core Principle of Defense in Depth
The basic idea is quite straightforward:
Never rely solely on one security control.
But rather use multiple controls that offer:
- Prevention
- Detection
- Response
- Containment
- Recovery
And the layers should help each other and not just do the same thing repeatedly.
For instance, when the attacker has stolen the password, MFA will prevent any unauthorized access. But if somehow the attacker has bypassed MFA, then the endpoint security will help detect any suspicious actions. And when the malware gets executed, then the network monitoring will detect any unusual traffic.
This is layering.
The Major Layers of Defense in Depth
A mature Defense in Depth strategy generally includes multiple security layers
- Physical Security
Cybersecurity starts from physical security.
In the case where an intruder has physical access to a server, workstation, networking hardware, or storage systems, many forms of cybersecurity measures can be bypassed.
Examples of physical security include:
- Security guards
- Access control card
- Biometric access
- CCTV cameras
- Security alarm
- Locking down the server room
- Visitor control
- Environmental controls
- Physical barriers
For critical facilities such as data centers, physical security is an important aspect of cybersecurity.
- Identity and Access Management
This brings us to the next level of access control.
IAM controls ensure that users have just the access that they require to do their work.
Key controls in this area are:
- Authentication
- MFA
- Role-Based Access Control
- Least privilege
- Privileged Access Management
- Account life cycle management
- Access reviews
Of particular importance is the least privileged principle.
Users should be given just the permissions that they need.
Should the account of a regular employee get hacked, then the limited permissions help to mitigate further damage.
- Network Security
There is another form of defense which can be implemented between the attackers and the internal environment.
The following are examples of network security techniques:
- Firewall
- Network Segmentation
- IDS
- IDP
- Secure Gateway
- Network Access Control
- VPNs
- Secure DNS
- ZTNA
Network Segmentation
It is a process whereby the entire network is segmented into different security zones.
Examples:
User Network → Application Network → Database Network
In case of an attack on the user workstation, network segmentation will prevent easy access to sensitive databases.
- Endpoint Security
Each laptop, desktop, mobile device, and server constitutes a possible attack vector.
Endpoint security is an approach to securing these devices against any sort of harmful actions.
Some of the control measures include the following:
- Endpoint detection and response (EDR)
- Anti-virus and anti-malware
- Host-based firewall
- Device encryption
- Application control
- Patch management
- Mobile Device Management
- Secure configuration
Apart from scanning for viruses, modern endpoint security can detect suspicious behavior.
- Application Security
Application becomes an easy target due to possible weaknesses in software that can be used for gaining access to the system without permission.
Application security comprises the following elements:
- Secure development of the software
- Code review
- Vulnerability scanning
- Penetration testing
- Security testing
- Secure authentication
- API security
- Dependency management
Security should be implemented into the process of the Software Development Life Cycle (SDLC).
- Data Security
After all, most cyber-attacks attempt to manipulate or steal the data.
Some of the ways to secure the data are:
- Encryption
- Data loss prevention
- Access controls
- Data Classification
- Backups
- securely deleting data
- database security
- data monitoring
Sensitive data needs to be secured in both states:
At rest
And
In transit.
Encryption minimizes the chances that the stolen data will be misused.
- Security Email
Email is one of the most frequently used vectors for attacks.
Attackers utilize email for:
- Phishing
- Malware distribution
- Business email compromise
- Credential stealing
- Social engineering
Organizations can enhance their email security by implementing:
- Spam filters
- Phishing detection tools
- Malware scanning
- Attachment analysis
- Link protection
- Domain authentication
- Security awareness for employees
Additionally, technologies like SPF, DKIM, and DMARC can assist organizations in protecting themselves from some types of email spoofing and impersonation attacks.
- Security Monitoring and Detection
Despite the best preventive controls in place, no system is foolproof when it comes to an attacker gaining access to the network.
Thus, it becomes important for companies to have mechanisms to detect any malicious activity.
Security monitoring can consist of:
- Security Information and Event Management (SIEM)
- Endpoint Monitoring
- Network Monitoring
- User Behavior Analytics
- Threat Intelligence
- Security Operations Center
It all boils down to detecting any anomalous behavior as soon as possible.
Some of them can be:
- Multiple failed login attempts
- Access from unusual geolocation
- Excessive data transfer
- Abnormal administrative activity
- Suspicious process execution on endpoint
- Suspicious communication with infrastructure
- Incident Response
However, detection alone is not enough.
There needs to be a structured approach to responding to security incidents.
Incident Response Plan
- Preparation
- Detection and Analysis
- Containment
- Eradication
- Recovery
- Lessons Learned
The more prepared an organization is, the better its chances of quickly responding to an attack.
- Backup and Recovery
Some types of attacks can never be totally prevented.
The use of ransomware can serve as an appropriate example.
In a situation where the attackers encrypt the systems used for production, there are some secure backups that can help organizations recover from such an attack without depending wholly on the attacker.
An efficient back-up plan should take into consideration the following factors:
- Regular backup
- Off-line/back-up
- Access control
- Encryption
- Backup integrity testing
- Recovery testing
It would be wrong to assume that a back-up that has never been tested is always a good one.
- Security Awareness and Human Defense
However, technology is not the only component of the “Defense in Depth” strategy.
Employees are also another security layer that companies should take into account.
The security awareness training for employees must inform them about the following security threats:
- Phishing
- Social engineering
- Suspected files and attachments
- Malicious links
- Login page spoofing
- Business email compromise
- Sudden multi-factor authentication
- Policies, Governance, and Risk Management
Technical controls require policy and governance support.
The organization should develop policies for topics such as:
- Password management
- Access control
- Data classification
- Acceptance of acceptable technologies
- Incident response
- Remote access
- Vendor security
- Backup management
- Security awareness
Governance of security provides for managing cybersecurity as an organizational risk issue and not only an IT issue.
Defense in Depth vs. Defense in Breadth
These two concepts can get confusing at times.
Defense in Depth revolves around protecting a common target or attack vector from various layers.
Defense in Breadth can be considered the protection of other regions within the environment like endpoints, cloud computing, applications, users, networking, and data.
A successful cybersecurity strategy must have both.
Defense in Depth and Zero Trust
Both Defense in Depth and Zero Trust are compatible strategies.
The questions that Defense in Depth poses include:
“How can multiple layers defend this system?”
In contrast, the Zero Trust strategy poses questions like:
“Should this user/device/connection be trusted?”
Zero Trust is based on constant validation, least privilege, and reduction of implicit trust.
Combining both these strategies would result in effective security.
Defense in Depth for Cloud Environments
Cloud computing has revolutionized the way organizations create security architecture.
The conventional approach to networks is no longer adequate.
Components of Cloud Defense in Depth could be:
- Stringent identity controls
- Multi-factor authentication (MFA)
- Conditional access
- Cloud security posture management
- Encryption
- Secure API
- Network segmentation
- Logs and monitoring
- Workload security
- Data Loss Prevention
Cloud computing demands that organizations ensure the security of identities, configurations, workloads, applications, and data but not a physical network perimeter.
Defense in Depth for Remote Workers
Remote workers will have access to the organization’s systems from their homes, public networks, and diverse devices.
The security components could include:
User authentication → MFA → Device verification → Endpoint security → Application security → Monitoring
Organizations need to guard against the assumption that remote devices are safe just because the user is legitimate.
Defense in Depth Against Ransomware
Ransomware shows the importance of layered defenses.
A defense against ransomware might entail:
- Email scanning
- Security education
- MFA
- Endpoint security
- Application controls
- Network segmentation
- Low privileges
- Vulnerability management
- Continuous monitoring
- Off-line backups
- Incident response planning
Should ransomware break through a first layer of defense, other measures would hinder its spread.
Defense in Depth and Supply Chain Security
Increasingly organizations rely on third-party software, vendors, cloud services, and other partners.
A vulnerable vendor may be a vector in the organization’s environment.
Therefore, Defense In Depth must include:
- Vendor Risk Assessments
- Third-party access controls
- Authentication
- Network segmentation
- Observation
- Software Integrity Controls
- Security in contracts
- Vendor assessment over time
Organizations must assume that trusted relationships can also be risky.
How to Build a Defense-in-Depth Strategy
Organizations can approach Defense in Depth systematically.
Step 1: Identify Critical Assets
Identify the most important assets that must be safeguarded.
Examples are:
- Consumer information
- Money information
- Intellectual property
- Authentication mechanisms
- Manufacturing systems
- Critical infrastructure
Step 2: Identify Threats
Identify the key threats.
Some examples are:
- Phishing
- Ransomware
- Insider threats
- Credential theft
- Supply chain attacks
- Vulnerabilities
Step 3: Map Attack Paths
Explain how an attacker can get from the starting foothold to the asset.
For instance:
Phishing attack → Stolen credentials → Accessing the account → Privilege escalation → Accessing data
Step 4: Add Multiple Security Controls
Place appropriate controls at different stages of the attack path.
Step 5: Test the Defenses
Tests include:
- Vulnerability assessment
- Penetration testing
- Red team exercise
- Tabletop exercise
- Security audit
The process will help to highlight any discrepancies between theory and practice.
Step 6: Monitor and Improve
Threats never stop changing.
Security personnel should constantly update themselves with:
- Security alerts
- Incidents reports
- Vulnerabilities
- Access privileges
- Configurations
- Threat intelligence
Defense in Depth must be considered as an on-going exercise and not just a one-off project.
A Practical Defense-in-Depth Model
A simplified representation would be the following:
Physical Security
↓
Identity and Access Management
↓
Network Security
↓
Endpoint Security
↓
Application Security
↓
Data Security
↓
Detection & Monitoring
↓
Incident Response
↓
Backup & Recovery
Every layer is designed to counter various threats.
The power of the whole structure lies in the interaction between these layers.
The Benefits of Defense in Depth
Decreased Effectiveness of Attack
Many controls make it harder for attacks to succeed.
Reduced Impact
Should the attack manage to break through one-layer, other controls will reduce its effect.
Increased Speed of Detection
Monitoring creates chances for early detection of attacks.
Enhanced Resilience
The capability to recover makes it easier to regain normal functionality.
Effective Risk Management
Layered security lessens the reliance on one technology or process.
Continued Business Functionality
Organizations can carry on operating despite system compromises.
The Future of Layered Security
Adaptive Security Architectures are becoming the future of cybersecurity.
Key elements in future Defense in Depth approaches will be:
- AI-based detection
- Continuous identity verification
- Zero Trust architecture
- Native cloud security
- Automated incident response
- Behavioral analytics
- Security orchestration
- PHISH-Resistant Authentication
- Vulnerability management
More focus will be on preventing, detecting, containing, adapting to and recovering from attacks rather than just having higher walls.
Conclusion
Defense in Depth is one of the most important cybersecurity principles.
The main idea behind it is quite simple: don’t rely on just one security measure for the protection of your most valuable assets.
Firewalls can be compromised. Passwords can be stolen. Antivirus software may allow malware to slip through. Employees might make a mistake. Some vulnerabilities might go unnoticed by developers.
However, when there are several security measures working at once, the failure of one of them doesn’t have to mean that the attack succeeded.
A mature approach to Defense in Depth includes such aspects as physical security, identity management, multifactor authentication, network security, endpoint security, application security, data security, monitoring, incident response, awareness of employees, governance, and backup and recovery processes.
Above all else, Defense in Depth is not about acquiring the biggest amount of cybersecurity tools. It is about creating complementary security measures, which would cover various stages of the attack and offer resilience in case of failure of any measure.
In the modern world of ever-evolving cyber-attacks, you must be ready to accept that sooner or later at least some of your security measures will be compromised. What really matters is how ready your organization is to face this situation.
One measure can fail. Several coordinated measures can save the day.
