What is a Defense in Depth Strategy?
Table of Contents
Cybercriminals are skilled at finding ways to infiltrate a corporate network. They manipulate employees, exploit vulnerabilities and processes, utilize AI to facilitate sophisticated social engineering, and install malware. The multitude of tactics, techniques, and methods (TTPs) used by attackers means that no point solution can prevent an attack. To counter this, the concept of a Defense in Depth Strategy has been developed.
What is a Defense in Depth Strategy?
The concept of using multiple layers of security measures to create a Defense in Depth (DiD) approach to protect a company's assets was originally a military strategy. DiD is a comprehensive set of security measures to protect the entire organization. The idea is based on implementing layers of technical, operational, and human-centric measures to ensure that even if one measure fails, the next layer will prevent an attack.
NIST defines DiD as being:
"The application of multiple countermeasures in a layered or stepwise manner to achieve security objectives. The methodology involves layering heterogeneous security technologies in the common attack vectors to ensure that attacks missed by one technology are caught by another".
The ultimate goal of Defense in Depth is to protect the confidentiality, integrity, and availability of a corporate network and company data.
Why is a Defense in Depth Strategy Needed?
Organizations must contend with massive volumes of security threats. Many modern cyber threats are based on complex, multi-part chains and increasingly use sophisticated AI-assisted tactics. The result is a war of attrition between cybercriminals and security vendors.
Antivirus software, for example, has evolved to utilize AI-enabled virus identification technologies in an attempt to identify evasive malware, such as polymorphic malware. Similarly, email filtering solutions have been thwarted by advances in phishing, such as the use of QR codes to obfuscate phishing URLs. Many email filtering solutions now utilize AI to identify emerging and evasive threats.
Compounding the issues of sophisticated volumetric threats are the common use of Cloud and hybrid environments, which are challenging to protect using point solutions. Also, mobile devices expand the corporate perimeter to create a broad attack surface. Even insider threats can be extremely difficult to detect, as insiders often use their access privileges to exfiltrate sensitive data.
All environments have potential security vulnerabilities, such as unpatched software and firmware, poorly implemented access privileges, remote employees connecting via insecure Wi-Fi, a lack of or poorly implemented encryption, and so on. Even with AI assistance, single-point security solutions are not enough to cover the myriad of areas that offer exploitation opportunities. To counter multiple threats, multiple layers of defenses are needed to create Defense in Depth.
Essential Layers of a Defense in Depth Approach
Three essential overarching layers comprise a Defense in Depth approach to securing company assets:
Administrative
Administration forms a baseline layer for an effective DiD strategy. The policies and procedures are essential frameworks and guidelines for achieving layered security that fit with your company and industry sector. Examples include policies on incident response and procedures to mitigate a ransomware attack.
Physical
Protecting assets from physical breaches is as important as cyber measures. Assets like servers and data centres must have physical protection to prevent cybercriminals from entering rooms containing essential IT resources or accessing computers to steal data or wreak computing resources.
Technical
Technical security measures comprise a combination of solutions addressing specific exploit points. For example, email filtering, web application firewalls, and identity management are all technical layers that work alongside physical and administrative layers to build a Defense in Depth. Some of these measures may be part of a unified system that consolidates various security solutions under a single service.
Benefits of Using a Defense in Depth Approach to Security
A Defense in Depth approach to security is a considered and strategic way to approach the complex nature of modern security threats. Creating a robust security posture in this way reaps benefits, including:
Prevent Multiple Types of Cyberattacks
There are many types of cyberattacks, each of which uses specific vectors, often involving multiple components in a complex chain of attack. The tactics, techniques, and procedures (TTPs) of a cyberattack encompass a wide range of methods to compromise and infiltrate a company and its personnel. Using a DiD approach means that an organization has broad coverage against many types of TTPs. Additionally, Defense in Depth establishes fallback positions in case one of the security measures fails.
Meet Regulatory Compliance
By using a DiD approach to security, a company effectively creates a robust security posture. Data protection regulations and standards mandate this layered approach to security, which incorporates human-centric and policy-based measures.
Reduce the Cost of a Cyberattack
Cyberattacks are expensive to a company. The costs include damage to IT resources, downtime, data theft, loss of intellectual property, ransoms, regulatory fines for noncompliance, and reputation damage. The average cost of a data breach is $4.88 million, and the median cost of a ransom is $200,000. Defense in Depth provides the most effective way for an organization to mitigate cyber threats and, therefore, help to reduce the costs of a cyberattack.
Best Practices, Policies, and Tools for a Defense in Depth Strategy
Implementing a Defense in Depth approach to cybersecurity requires an organization to be comprehensive in its approach. The following areas are those that are usually covered when developing a DiD strategy:
Operational Security
To begin the process of developing and implementing a DiD strategy, a company must create a series of policies and processes, including the following:
- Policies and procedures use frameworks such as the NIST Cybersecurity Framework (CSF) to help establish a plan of action and what policies and procedures to use.
- Incident response must be based on a strong and clear policy on how to deal with incidents, which helps to establish rules of engagement and procedures that can be followed in the event of a security incident.
- Data analyticsallow you to predict threats and optimize operations and defenses. Vendors like Databricks provide data analytics engines for cybersecurity.
- Vendor risk management is essential to prevent supply chain attacks.
Network Security
The following technologies and measures are typically used to provide robust, layered protection:
- Firewalls and web access firewalls (WAFs).
- Intrusion Prevention (IDP) to identify and prevent external attackers.
- Network segmentation and zero-trust network access (ZTNA) help isolate areas of a network, thereby mitigating broader attacks.
- VPNs or alternatives for remote employees for secure network access.
- Continuous monitoring of network traffic and behavioral analysis of employee actions.
- Patch management regularly, and as patches become available
Data Security
Data is challenging to protect across disparate and hybrid environments. Compounding protection is remote working, who need to create and share data from remote locations outside the corporate defenses. The following technologies are part of a Defense in Depth security strategy:
- Visibility tools to identify SaaS apps where data is created and likely to be shared
- Classification is essential to set effective access management and security policies.
- Access management is dictated by the classification of data and by the roles of employees accessing that data. The principle of least privilege and zero standing privileges helps to mitigate data theft and loss.
- Encryption of data during storage and sharing.
- Data masking to obfuscate sensitive data and enhance privacy.
- Backup and recovery to ensure a fast recovery from attacks like ransomware.
Endpoint Security
Endpoints include mobile devices, laptops, Point of Sale (PoS), printers, IoT devices, and so on. Protection of all endpoints ensures that the corporate perimeter extends to cover the entire potential attack surface:
- Endpoint protection includes encryption, next-generation antivirus (NGAV), and identity management (usually as a unified endpoint security solution).
- Endpoint Detection and Prevention (EDR) provides visibility across all endpoints and monitors these endpoints looking for potential cyberattacks.
- Access controls and multi-factor authentication (MFA) are essential to the secure access and sharing of data across endpoints.
Application Security
Applications are exploited by cybercriminals who look to steal data and take control of applications:
- Mobile Device Management (MDM) is used to manage mobile device use and security. MDM will ensure that lost or stolen devices are remotely wiped and enforce security policies that prevent the installation of unauthorized shadow IT apps.
- Measures that prevent vulnerability exploitation, such as SQL injection and Man in the Middle (MitM) attacks, should be enforced.
- Distributed Denial of Service (DDoS) attack prevention.
- API security protects the connections between applications.
Human-Centric Security
The majority of cyberattacks have a human element, according to Verizon. Employees and customers should be guided on security risks and how to prevent data leaks and other security incidents:
- Employee training is provided by security awareness training programs that educate employees about a multitude of risk areas. Modules include safe internet use, phishing attacks, mobile device security, and data protection.
- Phishing simulation exercises are typically offered as part of a security awareness training program. Fake phishing emails are regularly sent to employees to train them to identify and handle phishing attacks and how to report an incident.
Physical Security
Physical IT resources are also part of a comprehensive Defense in Depth approach to security. Physical resources, such as data centers, computers, and servers, must be protected from unauthorized access and harm using methods like biometric access control.
Further Reading
The following are helpful when developing a Defense in Depth approach:
- D3FEND™ A knowledge graph of cybersecurity countermeasures
- OWASP Top Ten Threats
- NIST Measuring and Improving the Effectiveness of Defense-in-Depth Postures
Conclusion
Robust and effective security is not achievable using a point solution. Systems are complex, environments are often hybrid, and expanded by remote workers and BYOD. Defense in Depth is a comprehensive and multi-layered approach to securing an organization's IT infrastructure, assets, and data. A DiD approach captures weaknesses throughout the organization, from data to applications, to the network, and the humans who use corporate resources. In an era where threats are evolving, using a Defense in Depth approach ensures an organization has a robust security posture.
FAQs
Is layered security the same as Defense in Depth?
While the two terms are often used interchangeably, they do have different meanings in the context of cybersecurity. Layered security addresses the concerns of single threats, for example, by using multiple layers of measures to prevent ransomware. Defense in Depth is a comprehensive approach that utilizes multiple controls to protect the entire organization. However, DiD uses layers of protection measures to cover a multitude of threats.
Which regulations and standards benefit from a Defence in Depth approach to security?
Any data protection or privacy standard or regulation will benefit from a Defense in Depth approach. This includes GDPR, PCI DSS, HIPAA, and SOC 2.
How does the NIST CSF relate to Defense in Depth?
The NIST Cybersecurity Framework (CSF) is a series of guidelines and best practices that form a framework. An organization can use the CSF as a baseline for a Defense in Depth approach. The CSF also aligns with security standards, allowing an organization to map its operations to regulatory requirements. Similarly, the Cyber Defense Matrix, developed by Sounil Yu, employs a framework similar to the CSF to map cybersecurity risks to capabilities.