What is Defense in Depth?
In the information security industry, the threat of increasingly sophisticated attacks on computer networks and systems, as well as the growing presence of attackers motivated by political, social, religious, or economic issues, is well known.
This year, the Verizon 2020 Data Breach Investigations Report(DBIR) examined over 32,000 security events and over 4,000 verified breaches from around the world. Here are some recent troubling developments:
- Since the 2019 DBIR, the number of data breaches has doubled.
- A startling 86 percent of data breaches were carried out for monetary gain (71 percent in the prior DBIR)
- Corporate email compromise, phishing, and credential theft were all implicated in 67 percent of the attacks.
- Web application attacks surged to 43 percent, more than doubling from the previous year.
Corporate security teams are fully aware of the need for stronger defenses against attacks containing several exploits, and they are continuously looking for countermeasures to increase their defensive capabilities. They've learned the hard way that a network can't be fully protected by a single security mechanism. For example, an external firewall will not protect valuable assets from an insider, but it will create a major barrier to an outside attacker. Similarly, to an outside attacker, policies and procedures are worthless, but they should be part of any plan to secure a network from within.
The term "defense in depth" has been used to describe a multilayered security architecture that includes the deployment of antivirus software, firewalls, and intrusion-detection software. The objective is to layer security by combining technical components with strong security management practices to lower the risk of attack or intrusions.
Implementing a defense-in-depth plan will ideally defeat or deter all types of attacks. As cyber threats grow and methods become more nasty and automated, Defense in Depth provides IT professionals with a robust, all-encompassing information security approach. Firewalls, switched networks, intrusion prevention systems, well-trained users, strong passwords, policies and procedures, and solid physical security are some of the critical items in an effective security plan. Each of these measures is of limited use on its own and can not provide comprehensive security for your network infrastructure. However, when combined, they become far more valuable as part of an overall security strategy and provide more effective security against cyber threats.
Defense in Depth should be viewed as a collection of connected and overlapping technological and nontechnical security measures that, when properly deployed together, have a bigger impact than the sum of their parts.
In this article, we will briefly discuss the following aspects of the Defense in Depth (DiD) strategy:
- What does Defense in Depth Mean?
- Why is Defense in Depth Important?
- How Does Defense in Depth Work?
- What are the Types of Defense in Depth?
- What are the Elements of Defense in Depth?
- What are the Essentials Layers in a Defense-in-Depth Mechanism?
- What is a Defense in Depth in Cybersecurity?
What does Defense in Depth Mean?
Defense in Depth (DiD) is a data security technique in which a succession of security procedures and controls are deliberately placed throughout a computer network to safeguard the network's confidentiality, integrity, and availability.
The National Security Agency (NSA) devised this layering strategy as a holistic approach to information and electronic security. This term is based on a military tactic of the same name, but the notion is fundamentally different. The military strategy focuses on weaker perimeter defense and intentionally giving space to buy time, envelop, and finally counter-attack an opponent, but the information security strategy simply comprises numerous layers of controls without intentionally losing territory.
According to the idea of defense-in-depth, multiple layers of security controls (defense) are installed across an information technology (IT) system. While there is no security solution that can prevent all cyber threats alone, when used together, they can protect against a wide range of attacks while also providing redundancy in the event that one method fails. This strategy, if implemented effectively, dramatically improves network security against a variety of attack vectors. An effective DiD approach can cover technical, procedural, and physical security during the life of the system.
The scale and sophistication of today's cyber threats are continually increasing. Defense in depth is a comprehensive strategic plan that combines all of the organization's security requirements to handle all challenges connected to the endpoint, application, and network security. It presupposes a predictive, larger, and more diversified perspective of defense rather than only dealing with an attack.
A strong defense-in-depth approach not only prevents cyber threats from occurring but also can block an attack that is already underway, preventing further damage. This strategy employs a variety of security techniques to safeguard all of an organization's assets.
Traditional network security solutions such as firewalls, secure gateways, antivirus software, and virtual private networks (VPNs) are still important in a defense-in-depth approach. More advanced methods, such as the use of machine learning (ML) to spot anomalies in endpoint and user behavior, are now being employed to develop the strongest and most comprehensive defense feasible.
Why is Defense in Depth Important?
Today, as work-from-home demands continue to rise at various levels for businesses all over the world, the security risks are becoming more severe. The reality is that when remote workers use cloud apps to access and share data while working outside of the traditional network perimeter, they not only jeopardize the effectiveness of digital transformation programs but also expose new attack vectors.
As more employees work from home, organizations must handle the security issues associated with employees utilizing their own devices for work and their home Wi-Fi connection to access the corporate network.
Furthermore, as more businesses use cloud-hosted Software-as-a-Service (SaaS) applications, many of which are mission-critical, managing the privacy and security of a growing amount of data entered through websites has become more complex.
The benefit of Defense in Depth comes from its methodology of combining advanced security solutions to protect sensitive data and prevent threats from reaching endpoints and networks. Defense in Depth strategy shines, as it recognizes the macro controls required for ultimate network protection, covering physical, technical, and administrative parts of the network.
The risk of a compromise is reduced by stacking and even duplicating security processes. Most businesses know that a single layer of protection or a single point product, such as a firewall, is insufficient to defend them from today's cyber attack’ rising sophistication. Layered security for corporate networks combines numerous cybersecurity solutions to limit the attack surface of a network and protect it from all sides.
A defense-in-depth strategy, provides multi-layer security and prevents threats because if one security product fails, another is ready to take over. If a hacker successfully infiltrates an organization's network, for example, defense in depth allows managers to activate countermeasures in time. To prevent further intrusion, antivirus software and firewalls should be installed, protecting the organization's applications and data.
Redundancy is another benefit of multilayer security. Other security measures can assist in reducing the harm to an organization's network if an external attacker takes down one line of protection or an insider threat penetrates part of the network. Using only one security solution, on the other hand, presents a single point of failure; if it is hacked, the entire network or system may be breached or harmed.
The time and complexity necessary to successfully infiltrate a network are greatly increased by the Defense in Depth technique, which drains the resources of engaged cyber threat actors and raises the odds of an active attack being detected and neutralized before it is completed.
In addition to cybersecurity, Defense in Depth provides a greater level of protection by focusing on the administrative and physical controls that a corporation should regulate to stay secure.
When it comes to protecting precious equipment or other material assets, a Defense in Depth method is commonly used in physical security.
How Does Defense in Depth Work?
To restrict the spectrum of possible attack vectors, organizations need numerous security layers, including firewalls, antimalware and antivirus software, intrusion detection systems, data encryption, physical controls, and security awareness training.
The following types of security technologies and solutions are an example of successful defense-in-depth layers:
- Firewalls: Firewalls are software or hardware appliances that have access or deny policies or rules to manage network traffic. IP addresses, MAC addresses, and ports may be blacklisted or whitelisted according to these criteria. Web Application Firewalls (WAF) and secure email gateways are examples of application-specific firewalls that focus on detecting harmful activity directed at a specific application. You can avoid lateral attacks and isolate your system by using multiple firewalls as an internal and an external.
Network segmentation: The technique of separating a network into various sub-networks based around unique business objectives is known as network segmentation. This model, for example, frequently comprises sub-networks for executives, finance, operations, and human resources. These networks may not be able to interact directly depending on the amount of protection necessary. Network switches or firewall rules are frequently used to create segmentation.
Patch Management: The process of applying updates to operating systems, hardware, software, and plugins is known as patch management. These patches are frequently used to resolve known vulnerabilities that could allow unwanted access to computer systems or networks.
- Intrusion Prevention or Detection Systems (IPS): While IDS tools issue an alarm when malicious network traffic is discovered. IPS tools try to prevent and warn of suspected malicious activity on the network or on a user's desktop. The signatures of known malicious network behavior are used to recognize attacks in these solutions.
- Endpoint Detection and Response (EDR): A software or agents are installed on the client system, such as a user's notebook or mobile device) and provide antivirus protection, detection, analysis, alerting, and threat intelligence.
- Privileged Access Management (PAM): PAM solutions provide capabilities for securing privileged accounts and credentials for both humans and non-humans. Passwords are kept and distributed in a secure vault, cycled on a regular basis, and usually coupled to multifactor authentication. According to the principle of least privilege, users, systems, and processes are only given access to resources that are absolutely necessary to accomplish their assigned purpose,
Beyond these standard layers of cyber security solutions, the Defense-in-depth principles have grown to include more than just detecting and halting an attack or breach. Additional security measures like incident response, disaster recovery, reporting, and forensic analysis are included in a larger, more strategic definition of defense-in-depth.
The key to defending your information systems is to make sure that all defense-in-depth components are up to date, and that your end users are following policies and procedures. It doesn't matter what security measures you have in place if you don't have proper policy compliance because one individual's behavior can bring considerable harm to your firm.
DiD implementation can be a time-consuming and resource-intensive process. As a result, organizations should examine existing network settings and ensure essential sensitive assets are protected using a risk-based approach.
What Are the Types of Defense in Depth?
While defense in depth methods vary depending on an organization's goals and resources, they typically involve one or more of the following kinds of products:
1. Physical Control
Anything that physically restricts or inhibits access to IT systems is referred to as
physical control. They protect information technology systems, data centers, business buildings, and other physical assets against threats such as theft, tampering, and unauthorized access. Security cameras, fences, guards, dogs, alarm systems, ID card scanners, and biometric security are examples of numerous sorts of access control and surveillance solutions (e.g. fingerprint readers, facial recognition systems, etc.).
2. Administrative Controls
Administrative controls are the policies and procedures that have to be set by system administrators and security teams to minimize vulnerabilities in a company. Their goal is to guarantee that sufficient security council is given and that requirements are followed. Employee training to identify phishing schemes, automated access to programs based on the employee's position, hiring practices, data processing protocols, and security standards are examples of administrative controls.
3. Technical Controls
Technical controls are pieces of hardware or software that are designed to keep systems and resources safe. They're required to protect systems and applications from data breaches, DDoS attacks, and other dangers. Disk encryption, file integrity software, firewalls, secure web gateways (SWG), browser isolation technologies, endpoint detection, and response (EDR) software, intrusion detection and prevention systems (IDS/IPS), data loss prevention software (DLP), web application firewalls (WAF), and anti-malware software are some of the most common security products at this layer. Hardware technical controls differ from physical controls in that they restrict access to a system’s contents rather than the physical system itself. The most sophisticated controls are technical controls, which encompass the combination of goods and services that a business uses to manage security.
Figure 1. Types of Defense in Depth
A basic defense in depth approach combines physical, technical, and administrative restrictions. Furthermore, many security professionals employ security tools that constantly monitor themselves and their vendors for potential security flaws.
The following security layers also aid in the protection of specific aspects of your network:
- Data protection: Data encryption at rest, secure data transmission, hashing, and encrypted backups are all examples of data protection strategies.
- Perimeter defenses: Firewalls, intrusion detection systems, and intrusion prevention systems are examples of network perimeter defenses.
- Monitoring and prevention: Logging and auditing network activity, sandboxing, vulnerability scanners, and security awareness training are all used to monitor and prevent network attacks.
- Access measures: Authentication restrictions, timed access, biometrics, and VPN are examples of access measures.
- Workstation defenses: Antivirus and anti-spam software are examples of workstation defenses.
What are Elements of Defense in Depth?
Security companies are constantly developing new security products to defend networks and systems against an ever-expanding array of security threats. The following are some of the most common security features seen in a Defense in Depth strategy:
1. Antivirus Software
Antivirus software is essential to stop malicious software from entering the network and spreading. Many antivirus software versions rely significantly on signature-based detection. While signature-based systems provide good protection against malicious software, they can be exploited by sophisticated attackers. As a result, it's a good idea to use an antivirus program with heuristic capabilities that look for unusual patterns and activities.
2. Behavioral Analysis
File and network actions can often provide insight into whether or not a breach is ongoing or has happened. If a behavioral analysis is enabled, it indicates that the firewall or intrusion prevention system has failed. Anomalies in employee behavior, as well as in the devices and applications themselves, can be detected using machine learning and algorithms. Behavioral analysis picks up the slack and can either send alarms or implement automatic controls to stop a breach from spreading. In order for this to work, organizations must establish a baseline for “normal” behavior.
3. Network Security Controls
The examination of network traffic is the first line of defense when it comes to network security. It allows an employee to access the network and use a device or application after they have been authenticated. Firewalls block traffic from and to banned networks and allow or prohibit traffic based on security requirements. In addition, intrusion prevention systems and firewalls usually work together to detect and respond to possible security threats.
4. Analyzing Data Integrity
A checksum is a number that is assigned to each file on a computer system. This is a mathematical representation of a file that reveals how often it is used, where it came from. It is very useful for data integrity analysis and can be used to check for malicious codes, such as viruses. If a file arrives that is completely unique to the system, it may be recognized as suspicious. Data integrity software can also verify the source IP address to ensure it is from a trustworthy source.
What Are the Essential Layers in a Defense-in-Depth Mechanism?
The cybersecurity products and services listed below are considered “fundamental” for any organization because they protect against serious cyber attacks that can swiftly cause costs, downtime, and reputational harm:
- Patch management
- Backup and recovery
- Strong, complex passwords
- Antivirus software
- Secure gateway
- The least privilege principle, or granting a user only the level of access or rights required to do his or her duties.
The following security layers become equally vital when organizations grow and adopt additional cloud services and employees access company networks remotely:
- Network segmentation
- Intrusion detection and prevention systems
- Endpoint detection and response (EDR)
- Two-factor authentication (2FA) or multi-factor authentication (MFA)
- Data loss prevention
What is a Defense in Depth in Cybersecurity?
As the drive toward digital transformation accelerates, our living and business processes are increasingly online and in the cloud. Keeping businesses and employees safe online necessitates advanced technological controls and increases the importance of the Defense in Depth strategy.
Cyber Attackers deploy sophisticated techniques to exploit flaws across the organization as the attack surface grows in size and complexity. The following are some of the most prevalent issues that businesses face while developing a cybersecurity strategy:
- Encryption is either missing or poorly implemented.
- Employees working from home are connecting to insecure networks like the internet.
- Patches are either not updated or are ignored.
- Employees are either unaware of or unconcerned about security policies.
- Deficiencies in physical security, such as insecure server rooms.
- Cloud service providers, for example, are not completely secure.
- Anti-malware software hasn't been updated or installed on any of the machines.
- Employees are falling prey to phishing tactics due to a lack of training.
It must be considered that all of these difficulties occur at the same time. A good, complete defense-in-depth strategy is the only method for an organization to protect itself from vulnerabilities. If one measure fails, another is waiting in the wings to take action.
Defense-in-depth cybersecurity application cases include end-user security, network security, and product design :
- An enterprise installs a firewall and encrypts both data traveling via the network and data stored at rest. Even if an attacker manages to break through the firewall and grab data, the information is encrypted.
- An organization may provide three layers of security by installing a firewall, employing skilled security operators to manage an Intrusion Protection System, and deploying an antivirus program. As a result, attackers can be recognized and prevented by the IPS even if they get past the firewall. If they get to a user's computer and try to install malware, the antivirus software will detect and destroy it.
- A company that sells software to protect end-users from cyberattacks can combine various security features into one product. Combining antivirus, anti-spam, firewall, and privacy controls, for example. As a consequence, malware and web application attacks are prevented on the user's network (e.g., XSS, CSRF).