📖 What is Defense in Depth?
Defense in Depth is a security strategy that employs multiple layers of security controls throughout an information technology system. If one security layer fails, others are in place to stop the threat, reducing the likelihood of a total system compromise.
"Think of this as the 'onion' approach. It requires combining physical, technical, and administrative controls to create a redundant security posture."
📚 Certification: Security+ Certification Exam (SY0-701)
🔑 What are the Key Concepts of Defense in Depth?
- ▸ Layered Security Controls: Combining administrative, technical, and physical controls to ensure that no single point of failure exists within the overall security architecture.
- ▸ Administrative Controls: Policies, procedures, and training that guide human behavior and establish the organizational framework for security management and compliance.
- ▸ Technical Controls: Hardware and software mechanisms, such as firewalls, encryption, and MFA, that automatically protect systems and data from unauthorized access.
- ▸ Physical Controls: Tangible barriers like locks, security cameras, and guards that prevent unauthorized physical access to hardware and critical facilities.
- ▸ Redundancy and Resilience: The strategy aims to slow down attackers and provide multiple opportunities for detection, ensuring the system remains resilient despite individual control failures.
🎯 How does Defense in Depth appear on the SY0-701 Exam?
You may be asked to identify which combination of controls—such as a firewall, a security policy, and a badge reader—represents a complete defense-in-depth strategy for a server room.
A scenario might describe a breach where a perimeter firewall was bypassed; you will need to identify the next layer of defense, such as an IDS/IPS or host-based antivirus, that should stop the attack.
Expect questions where you must differentiate between a single strong control and a layered approach, selecting the option that minimizes the risk of a single point of failure.
❓ Frequently Asked Questions
How does Defense in Depth differ from Zero Trust?
Defense in Depth focuses on creating multiple layers of barriers to slow down attackers, while Zero Trust assumes the network is already breached and requires continuous verification for every access request, regardless of location.
Is adding more security tools always the best way to implement this strategy?
No. Effective defense in depth requires a strategic mix of different types of controls. Adding five similar firewalls is redundant but doesn't provide the layered protection of combining policies, technical tools, and physical locks.