How does defense in depth compare to other security models?
Today, IT security and risk management teams have different security frameworks or philosophies to choose from. There are instances when they must choose one over the other. In other cases, they can utilize multiple frameworks to focus on different aspects of an organization’s security posture. However, these frameworks overlap in terms of many principles and technologies. Let’s see how defense in depth stacks up against or compares to two other prominent cybersecurity standards.
Defense in depth vs. layered security
While the terms “defense in depth” and “layered security” are often used (incorrectly) interchangeably, they are two different cybersecurity standards. However, they are not two competing concepts and have a lot of overlap with each other.
According to Techopedia, “the central idea behind layered security or defense is that in order to protect systems from a broad range of attacks, using multiple strategies will be more effective. Layered security can involve security protocols at the system or network levels, at the application level, or at the transmission level, where security experts may focus on data in-use over data at-rest.”
The layered security approach focuses on protecting endpoints and networks entirely by putting in multiple security controls that can cover the failings of any individual ones. It implements different kinds of controls at different levels, hardening the security of each level. For example, if an intruder manages to get past the firewall, they will still be required to authenticate before proceeding further. Layered security thus assumes that a comprehensive strategy, which is more than the sum of its individual components, can secure the entire network. However, it has a singular focus on threat origins and doesn’t consider a broad range of possibilities, which can breach parameters like incidental threats that are part of dangers not explicitly targeted at protected systems.
Contrary to this, defense in depth assumes that any collection of security solutions can never achieve complete security. While defense in depth leverages most of the security practices used in layered security, it also goes one step further to implement a broader range of controls and tactics, adding as many hurdles as possible to slow down attackers trying to break into the network. Defense in depth can be called a multifaceted strategic plan where layered security is just a subset. It assumes a broader range of threat possibilities and delivers a more robust defense.
Defense in depth vs. zero trust
Zero trust and defense in depth are two comprehensive cybersecurity strategies that complement each other. TechTarget defines the zero trust security model as “a cybersecurity approach that denies access to an enterprise’s digital resources by default and grants authenticated users and devices tailored, siloed access to only the applications, data, services and systems they need to do their jobs.” Zero trust model is based on the concept of “never trust, always verify,” which requires users and devices to continually undergo authentication and authorization to access applications, data, services and systems.
The focus of the zero trust model is to prevent attackers from the outset by necessitating continuous verification of users and devices. Meanwhile, defense-in-depth strategy relies on multiple layers of defense mechanisms to prevent attackers from getting into the security perimeter. In fact, zero trust environments leverage defense-in-depth security principles to enhance the security posture. Combining defense in depth and zero trust frameworks makes your organizational security strategy even more potent.
What is the purpose of defense in depth?
In today’s ever-evolving cyberthreat landscape, a single security layer or a single product cannot completely safeguard a network from every threat it might face. Adding multiple security solutions and practices can help organizations on that front to effectively mitigate a whole range of threats. Defense in depth’s layered defensive mechanisms thus greatly aid enterprises in reducing vulnerabilities, containing threats and mitigating risks.
What is an example of defense in depth?
Consider the security measures in your workplace. Even if you get authorized to enter the office building, you might need another authentication to enter your floor. Similarly, even if security guards are there for surveillance, your office would have CCTVs at every nook and corner to monitor what has missed their eyes. Also, you need specific passwords and authentications to log in to your system, office suite and networks. The defense-in-depth model uses such a series of seemingly redundant defensive measures to protect an organization’s data and network.
What is the benefit of a defense-in-depth approach?
The major advantage of the defense-in-depth model is its efficiency in thwarting a diverse range of threats. As enterprises scale their users, systems and networks, their threat landscape also burgeons. If a threat actor infiltrates the network, the multiple security layers that defense in depth put in place, like firewalls, antimalware and antivirus software, intrusion prevention or detection systems, and physical controls, give IT teams ample time to devise countermeasures.
Another advantage of defense in depth is redundancy. While redundancy may seem wasteful in security at first glance, it closes the gaps created by individual solutions and effectively mitigates the damage to the entire network.
What are some drawbacks of defense in depth?
Since defense in depth involves multiple layers that must be implemented, managed and maintained, it can be difficult to coordinate them. Another disadvantage of defense-in-depth strategy is its cost. It can get more costly over time with licensing fees of multiple security products.
What are the 3 key layers of defense in depth?
Defense-in-depth model can vary according to an organization’s requirements and resource availabilities. Nevertheless, every defense-in-depth layered security architecture has three core parts — administrative controls, physical controls and technical controls — that are designed to protect your network’s administrative, physical and technical aspects.
Administrative controls are security measures that consist of policies and procedures directed at an organization’s employees. System administrators and security teams set these policies and practices to restrict permissions to users and guide them on how to enhance security. It includes control access to corporate assets, internal systems and other sensitive data and applications. Examples of administrative controls are information security policies, third-party risk management frameworks, information risk management strategies and cybersecurity risk assessments.
Physical controls are security measures that defend data centers, IT systems and other physical assets from threats like unauthorized access or data thefts. Measures like security guards, CCTVs, ID card scanners and biometric security that prevent physical access come under physical controls.
Technical controls encompass security measures that protect network security and IT assets using different types of hardware and software. Examples are intrusion protection or detection systems, web application firewalls, two-factor or multifactor authentications, biometrics, virtual private networks and encrypted backups.
How does defense in depth prevent attacks?
Defense in depth leverages an array of security products, policies and practices to limit the risk to network and resources. It implements different measures at different levels to bolster network security against various threat vectors.
Let’s look at some of the ways in which the defense-in-depth model thwarts cyberthreats.
Monitoring and prevention
Defense in depth implements different policies and tools to proactively detect cyberthreats and data breaches and protect corporate networks. The monitoring and prevention of cyberthreats involve various measures, including auditing and logging, vulnerability scanning and sandboxing. Security awareness training is also a significant step as it aids users and employees in understanding their role in preventing data breaches.
Meanwhile, organizations can leverage leading-edge technologies like artificial intelligence, machine learning and big data analytics to do a behavioral analysis of users and devices. This will help security teams identify anomalies and prevent attackers from executing their plans. Patch management is also a critical step in that regard since it fixes the vulnerabilities in applications and software.
The defense-in-depth model implements different authentication tactics to provide users and devices access to applications, systems and data. In addition to strong password security and biometrics, it implements two-factor or multifactor authentications and single sign-on. While multifactor authentication requires users to provide two or more verification factors to gain access to an asset or data, single sign-on empowers users to securely authenticate with different applications and platforms with just a single set of credentials.
The defense-in-depth model also implements different access controls for users and devices. Timed access control enables IT teams to control traffic to their network based on time periods. Similarly, least privileged access is an access control that provides devices and users only the access rights required to do the job.
Network segmentation, firewalls, VPNs, and intrusion detection systems (IDS) and intrusion prevention systems (IPS) are a few measures defense in depth takes to limit the exposure of applications and data within the network to outside users. Through setting up different wireless networks for internal and external users, network segmentation enables organizations to better protect sensitive data from unauthorized users. Similarly, firewalls are hardware or software appliances that control access to a network through policies and rules. VPNs create a secure tunnel for external users into a network and IDS and IPS alert and prevent malicious activities on networks.
Securing entry points or endpoints of user devices is also critical in the defense-in-depth model. Antivirus and anti-spam software, endpoint detection and response, and endpoint privilege management are different ways organizations can bolster their endpoint security.
Data encryption and data hashing to secure data from unauthorized users are also ways defense in depth enhances security. Notably, backup also has a critical role to play in an organization’s defense-in-depth strategy. Having a reliable backup and restore solution helps businesses recover business-critical data in the wake of an unfortunate event. A delay in recovering mission-critical data could drastically impact a business. A backup solution, especially one where data is stored securely on the cloud, empowers accurate and swift recovery, enabling enterprises to recover their data in minutes.
Support the defense-in-depth security model with Spanning 360
Spanning 360 is an enterprise-class, end-to-end protection for Microsoft 365 and Google Workspace that combines multiple layers of defense to strengthen data security. Spanning 360 helps prevent, anticipate and mitigate account compromise and data loss through a layered strategy.
Spanning 360 includes:
- A powerful phishing defense platform that leverages AI and machine learning to detect and block even the most sophisticated email threats.
- Spanning Dark Web Monitoring that scans the dark web for compromised or stolen credentials.
- Spanning Backup that provides comprehensive, automated backup of critical data.
To learn more about how Spanning 360 can enhance your defense-in-depth strategy, request a demo today.
Request a Demo