Defense in Depth is the layering of multiple defense techniques, mechanisms and devices to protect critical network assets, data, systems and users.
Defenses are layered for two primary reasons:
- First, as one layer, if a device or mechanism fails, another will be there to mitigate, or at least track and notify administrators, about the breach.
- Second, because attacks come from a multitude of sources and can target multiple access methods, one defense mechanism will not mitigate every potential path into the business.
Defense in Depth Considerations:
- Security Architecture.
- Risk and Compliance.
- Devices and Host Security.
- User Security (IAM).
- Data Security (DLP, Data-in-Transit and Data-at-Rest Encryption).
- Application Security Layer.
- Endpoint and Mobile Security.
- Network Security | Cloud Infrastructure Security Layer.
- Security Information and Event Management (SIEM) and Security Operations Center (SOC).
- Penetration Testing and Vulnerability Management.
Defense in Depth Implementation Best Practices:
- Micro-segmentation/Network segmentation – Perform proper segmentation of networks, DMZ and firewalls. In addition, separate DEV, QA and Production environments and isolate by line of business applications.
- Egress Network Traffic Filtering – Deploy border network proxies and configure all client services to pass through the proxies outbound.
- Secure Configurations – Configure systems with the most secure configuration that business functionality will allow, and use automation to keep users from installing/uninstalling software.
- Secure Technical Architecture – Leverage automation to ensure systems maintain secure configuration, patch up-to-date with the latest version of the operating system and software (keep EDR software up to date).
- Data Loss Prevention (DLP) – Protect sensitive data through encryption, data classification mapped against access control, and through automated data leakage protection.
- Security Awareness Training – Establish employee and business partner security awareness and provide penalties for those who do not follow acceptable use policy.
- Application Security (AppSec) – “Shift left”, adopt OWASP top 10 secure coding guidelines, implement secure CI/CD pipelining. Have clearly defined tools and processes for patching and removing security flaws in applications:
- SAST (Static code scanning).
- DAST (Dynamic code scanning).
- IAST (Interactive code scanning).
- SCA (Software Composition analysis).
- Patch and Vulnerability Management.
- Penetration testing.