Defense in depth is a concept used in information security in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited.[1]
The idea behind the defense in depth approach is to defend a system against any particular attack using several independent methods.[2] It is a layering tactic, conceived by the National Security Agency (NSA) as a comprehensive approach to information and electronic security.[3][4]
Defense in depth is sometimes thought of as forming the layers of an onion, with data at the core of the onion, people the next outer layer of the onion[clarification needed], and network security, host-based security, and application security forming the outermost layers of the onion.[5]
Defense in depth can be divided into three overarching areas: Physical, Technical, and Administrative.[6]
Physical controls are anything that physically limits or prevents access to IT systems. Examples of physical defensive security are: fences, guards, dogs, and CCTV systems.[3]
Technical controls are hardware or software whose purpose is to protect systems and resources. Examples of technical controls include disk encryption, file integrity software, authentication,[7] network security controls, antiviruses, and behavioural analysis software.[8]
In the event that one layer of defence fails, defense in depth aims to ensure network security via a second-line of defence.[3] For example, if an attacker penetrates a computer system at a given OSI layer (e.g. Layer 3), a redundancy should exist at another layer (Layer 7) to ensure layered defense.[3]
Administrative controls are the organization's policies and procedures and govern the organisation's human resources, technology, and operations.[3]