What is Defense-in-Depth (DiD)?

• IAM 用語集
• What is Defense-in-Depth (DiD)?

Defense-in-Depth (DiD) is a cybersecurity strategy that protects an organization's systems and data by layering multiple, independent security controls. This approach ensures that if one control fails, the others can continue to defend the network, data and users. Instead of relying on a single barrier, DiD creates a series of overlapping security measures that an attacker would have to breach sequentially. The concept of DiD originates from military strategy, where forces used successive lines of defense. Adapted to information security, DiD accounts for the reality that no single control is foolproof. By layering defenses, an organization reduces its dependence on any one control, slows attackers and gives security teams time to detect and contain a threat before it reaches its most valuable data.

The layers of defense-in-depth

Defense-in-depth organizes its controls into three main categories. A strong DiD strategy combines all three because each addresses a different way an attacker can compromise a system.

• Physical controls: Protect the hardware and facilities where systems reside, including locks, security guards, keycard access and surveillance cameras that deter unauthorized users from servers and workstations.
• Technical controls: Defend technology across networks, devices and applications. Several examples include firewalls, antivirus software, intrusion detection, encryption and Multi-Factor Authentication (MFA).
• Administrative controls: Govern how people work through policies and how an organization responds to threats. These controls cover security policies, incident response procedures and employee awareness training that reduces the risk of human error.

Common layers in a DiD model

In practice, DiD controls are deployed across multiple layers that protect an organization's most valuable assets. Each layer combines physical, technical and administrative controls to defend against a different set of cyber threats. Together, they force an attacker to breach one barrier at a time to reach the data at the core.

• Perimeter security: The outer boundary between an organization and the internet, protected with firewalls and gateways
• Network security: Segmentation and monitoring limit how much an attacker can do once inside a network
• Endpoint security: Protection for mobile devices, computers and servers, such as antivirus software and Endpoint Detection and Response (EDR)
• Application security: Safeguards built into software to minimize the exploitation of vulnerabilities
• Data security: Encryption, data loss prevention and backups that protect information directly
• Identity and Access Management (IAM): Controls that verify who users are and what they can access
• Physical security: Facility-level protections that keep attackers away from systems
• Policies and procedures: The governance and awareness layer that connects every other layer

Since identity is often the path attackers use to move between layers, strong Identity and Access Management (IAM) effectively reinforces multiple layers at once instead of sitting in just one place.

How defense-in-depth works

Defense-in-depth works on the principle that no single security control can be foolproof. Firewalls can be misconfigured, software contains vulnerabilities that haven't been patched yet and employees may occasionally click a phishing link. Any one defense, no matter how strong, can eventually fail or be bypassed. Instead of relying on a single barrier, DiD layers multiple independent controls so that the failure of one layer doesn't expose the whole system.

Picture this as a medieval castle that isn't protected by a single wall. An attacker who gets past the moat still faces the outer wall; once they scale the wall, they still have to get past the guards. DiD applies the same philosophy to IT security, wrapping an organization's most valuable data in concentric layers of protection that an attacker must breach one after another.

Benefits of defense-in-depth

Layering security controls delivers benefits that no single defense can provide alone. The main benefits of DiD include:

• Removes reliance on any single control: Since protections are redundant, one bypassed control is far less likely to lead to a full compromise. If an attacker gets past one layer, the next layer is already in place to slow or stop them, eliminating the single point of failure that comes from relying on a single defense.
• Buys time to detect and respond: Each layer an attacker has to work through takes time and produces activity that may be flagged by monitoring tools, giving security teams a larger window of opportunity to detect and respond to an intrusion.
• Defends against the full range of threats: A layered security strategy addresses many kinds of risk at once, including external attacks, insider threats and negligent actions by employees. Because each layer counters a different type of threat, the combination protects against many more scenarios than a single control could.
• Supports compliance and risk management: Many regulations and security frameworks anticipate that organizations will apply layered, overlapping protections. A DiD approach helps demonstrate due diligence and maps naturally to most compliance and risk management requirements.

Defense-in-depth vs zero trust

Defense-in-depth is a strategy of layered redundancy, with multiple independent controls stacked so that if one fails, others still protect the system. Zero trust is a security model built on the principle of "never trust, always verify," meaning every access request is authenticated and authorized regardless of whether it comes from inside or outside the network. DiD is concerned with layering diverse controls across the entire environment, while zero trust concentrates on continuously verifying identity and access at every point. These two concepts are complementary: Zero trust strengthens the identity and access layers within a broader DiD strategy, and DiD ensures that zero trust's access controls are backed by additional measures.

How to implement defense-in-depth

Defense-in-depth is an ongoing process of mapping what to protect, layering controls and continuously reviewing them as threats and infrastructure shift. Organizations can put DiD into practice by following these steps:

1. Inventory and classify assets. Identify what needs to be protected, including data, systems, applications and users, then run a risk assessment to determine what's most valuable and most exposed.
2. Map the attack surface. Identify the threats, vulnerabilities and entry points an attacker could exploit across every layer, from internet-facing systems to internal applications.
3. Select overlapping controls for each layer. Map physical, technical and administrative controls to an environment's layers (perimeter, network, endpoint, etc.). Prioritize control diversity by using different vendors and technologies across layers so that one vulnerability can't compromise an entire stack.
4. Enforce least-privilege access and strong identity management. Limit each user's access to only what's necessary and bolster it with IAM and MFA. Adding Identity Governance and Administration (IGA) and Privileged Access Management (PAM) further limits an attacker's lateral movement if they breach an outer layer.
5. Deploy monitoring, logging and detection. Continuous monitoring and logging across layers allow a breach in one layer to be detected and contained before it reaches core data. The sooner a breach is detected and addressed, the less damage it can do.
6. Prepare incident response and recovery. Maintain documented incident response plans and reliable backups so that when something does get through, teams can quickly contain the threat, remediate impacted systems and recover compromised data.
7. Prepare incident response and recovery. Maintain documented incident response plans and reliable backups so that when something does get through, teams can quickly contain the threat, remediate impacted systems and recover compromised data.
8. Train employees. Regular security awareness training operationalizes the administrative layer and addresses human error as a cause of breaches. Employees who can recognize phishing, social engineering and unsafe online practices become an active layer of defense instead of a weak point.