System and Infrastructure Security.
Dr. Kamal Alieyan.
Chapter 5: Defense in Depth
What is Defense in Depth?
Definition:
It is a concept in the field of information security that aims to increase security and
protection by creating multiple layers of defense to protect against potential attacks and
threats.
Defense in depth is a comprehensive strategy that relies on diversity and diversification
of security measures across different levels and elements of the computing
infrastructure.
These are some of the principles and techniques
used in Defense in depth:
1. Firewall.
2. Software and Systems Update.
3. Identity and Access Verification.
4. Encryption.
5. Intrusion Detection and Monitoring.
6. Malware Protection.
7. Training and Awareness.
1. Firewall
Used to separate internal networks from
external networks and filter unauthorized
traffic.
2. Software and Systems Update:
Security updates and necessary patches are
applied to software and systems used to close
known security vulnerabilities.
3. Identity and Access Verification:
Involves using multi-factor verification techniques,
such as strong passwords and two-factor
authentication, to verify users' identity and grant
appropriate permissions.
4. Encryption:
Used to protect data over a network by encrypting
and decrypting it, making it difficult for
unauthorized reading and use.
5. Intrusion Detection and Monitoring
Includes the use of Intrusion Detection Systems (IDS) and Security Information
and Event Management (SIEM) systems to detect illegal activities and alert those
responsible for security.
6. Malware Protection
Involves using anti-virus and anti-
malware software to detect and remove
malware and other threats.
7. Training and Awareness
Educating and Training users on good
security practices is an important part
of defense in depth, as they can
contribute to countering targeted
attacks and social hacking.
✓ The main idea behind defense in depth is to
distribute and diversify security measures
and technologies to reduce the opportunities
for attackers and increase the difficulty of
penetrating the infrastructure.
Two things you should always aware of:
1. When multiple security barriers and layers
are in place, it is difficult for attackers to
completely penetrate the system.
2. If an attacker can pass one
layer, he still faces additional
barriers to reaching his goals.
It should be noted that defense in depth not only means using
multiple security techniques, but also includes proper security
management practices such as:
Risk Assessment.
Application of Vulnerability
Security Policies. Management.
Emergency Incident Response.
Procedures.
In the figure above, we will explain the Defense in Depth Layers.
An example of this is how all software components are validated for hardening
while the solution also validates functionality with a secure architecture.
These two security practices help to create multiple layers of security around
the solution. For instance, if a threat actor finds a way through the network
boundary, such as a demilitarized zone (DMZ), then the use of authentication,
encryption, and authorization all help to mitigate any further potential
compromises.