📖 What is Defense in Depth?
Defense in Depth is a security strategy that employs multiple layers of redundant defensive controls throughout an information system. If one security layer fails, others remain in place to protect the asset and slow down an attacker.
"Do not confuse this with simple layered security. Defense in Depth requires that the layers are diverse, such as physical, technical, and administrative, to prevent single points of failure."
📚 Certification: CompTIA Advanced Security Practitioner+ (CAS-004)
🔑 What are the Key Concepts of Defense in Depth?
- ▸ Diverse Control Integration: Combining administrative policies, technical configurations, and physical barriers to ensure a failure in one control type does not compromise the entire system.
- ▸ Layered Redundancy: Implementing overlapping security measures so that attackers must bypass multiple independent obstacles, significantly increasing the effort and time required for a successful breach.
- ▸ Attack Surface Reduction: Utilizing multiple defensive layers to minimize available entry points and force attackers into predictable paths where they can be more easily detected.
- ▸ Detection and Delay: Using layers not only to block access but to slow down adversaries, providing security operations centers critical time to detect and respond to intrusions.
- ▸ Failure Independence: Ensuring that the compromise of one layer, such as a stolen password, does not automatically invalidate other layers like MFA or network segmentation.
🎯 How does Defense in Depth appear on the CAS-004 Exam?
You may be asked to evaluate a proposed architecture and identify the missing layer—such as adding physical security or administrative policies—to transform a simple layered approach into true Defense in Depth.
A scenario might describe a breach where a single firewall failure led to a total system compromise; you will need to recommend diverse controls to eliminate this single point of failure.
Expect questions where you must prioritize the implementation of diverse controls across the OSI model to protect a high-value asset from a sophisticated advanced persistent threat (APT).
❓ Frequently Asked Questions
How does Defense in Depth differ from the Zero Trust model?
Defense in Depth focuses on creating multiple perimeter and internal barriers to slow attackers. Zero Trust assumes the perimeter is already breached and focuses on continuous verification of every request, regardless of its origin.
Is adding multiple firewalls an example of Defense in Depth?
Not necessarily. Adding multiple firewalls of the same brand is redundant layered security. True Defense in Depth requires diversity, such as combining a firewall with an IDS, MFA, and strict administrative access policies.