What is Defense In Depth?

John Spacey, updated on November 23, 2016

Defense in depth is an IT security strategy that uses multiple layers of security controls. It is often explained with an analogy to a castle with many layers of defense such as moats, walls and finally a castle keep.

A basic principle of IT security is that components shouldn't trust each other. That is to say, that each component should assume that other components in an organization or technology stack have been compromised. It is impractical to have every single component in a large system that has no trust in anything. As such, layers are established that don't trust each other. The following are examples of layers used by defense in depth strategies.

Processes

Procedures

User Interfaces

Applications

Data Access Layers

Platforms

Servers

Operating Systems

Networks

Demilitarized zones

Data Repositories

The following are examples of techniques that may be used at each layer to implement security.

Training & situational awareness

Authentication & authorization

Pattern scanning such as anti-virus tools

Intrusion detection

Encryption

Perimeters such as firewalls

Audit trails

Sandboxes

Overview: Defense In Depth
Type	Information Security
Definition	An IT security strategy that uses multiple layers of security controls.
Related Concepts	Information Security Privacy Human Error