Core Concepts: Defense in Depth

Defense in depth is becoming an increasingly popular concept in the IT security community today. However, it's frequently misapplied. Having a defense-in-depth strategy is about more than just tossing out multiple controls and defensive technologies. The essence of defense in depth pertains to how you position, or array, those defenses. To do a really good job of incorporating a defense-in-depth strategy, you need to have done a decent threat analysis in which you identify:

The defense-in-depth concept has been around for thousands of years, so I'll turn to the often-used example of a medieval castle to show what defense in depth is and is not. To clearly communicate the defense-in-depth concept, let's keep things simple and consider only one of the threat vectors a castle must defend against: a direct attack on its front entrance. A castle has multiple defenses arrayed against this threat vector. When those defenses are properly implemented, attackers must overcome each defense before being able to truly threaten the human, military, political, or material assets the castle is defending. . . .