Defense in depth ( computing ) - wikipedia Defense in depth ( computing ) For the military strategy, see Defence in depth. This article needs additional citations for verification. Please help improve this article by adding citations to reliable sources. Unsourced material may be challenged and removed. ( April 2012 ) Defense in depth ( also known as Castle Approach ) is an information assurance ( IA ) concept in which multiple layers of security controls ( defense ) are placed throughout an information technology ( IT ) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited that can cover aspects of personnel, procedural, technical and physical security for the duration of the system 's life cycle. Contents 1 Background 2 Controls 2.1 Physical controls 2.2 Technical controls 2.3 Administrative controls 3 Examples 4 See also 5 References Background The idea behind the defense in depth approach is to defend a system against any particular attack using several independent methods. It is a layering tactic, conceived by the National Security Agency ( NSA ) as a comprehensive approach to information and electronic security. Defense in depth is originally a military strategy that seeks to delay rather than prevent the advance of an attacker by yielding space to buy time. The placement of protection mechanisms, procedures and policies is intended to increase the dependability of an IT system, where multiple layers of defense prevent espionage and direct attacks against critical systems. In terms of computer network defense, defense in depth measures should not only prevent security breaches but also buy an organization time to detect and respond to an attack and so reduce and mitigate the consequences of a breach. Controls Defense in depth can be divided into three areas : Physical, Technical, and Administrative. Physical controls Physical controls are anything that physically limits or prevents access to IT systems. Fences, guards, dogs, and CCTV systems and the like. Technical controls Technical controls are hardware or software whose purpose is to protect systems and resources. Examples of technical controls would be disk encryption, fingerprint readers, and Windows Active Directory. Hardware technical controls differ from physical controls in that they prevent access to the contents of a system, but not the physical systems themselves. Administrative controls Administrative controls are an organization 's policies and procedures. Their purpose is to ensure that there is proper guidance available in regards to security and that regulations are met. They include things such as hiring practices, data handling procedures, and security requirements. Examples Using more than one of the following layers constitutes defense in depth. Anti virus software Authentication and password security Biometrics Demilitarized zones ( DMZ ) Data - centric security Encryption Firewalls ( hardware or software ) Hashing passwords Intrusion detection systems ( IDS ) Logging and auditing Multi-factor authentication Vulnerability scanners Physical security ( e.g. deadbolt locks ) Timed access control Internet Security Awareness Training Virtual private network ( VPN ) Sandboxing Intrusion Protection System ( IPS ) See also Defence - in - depth ( Roman military ) References Jump up ^ Schneier on Security : Security in the Cloud Jump up ^ Defense in Depth : A practical strategy for achieving Information Assurance in today 's highly networked environments. Jump up ^ OWASP Wiki : Defense in depth Jump up ^ Stewart, James Michael ; Chapple, Mike ; Gibson, Darril ( 2015 ). CISSP ( ISC ) 2 Certified Information Systems Security Professional Official Study Guide. Retrieved from `` https://en.wikipedia.org/w/index.php?title=Defense_in_depth_(computing)&oldid=789149981 '' Categories : Computer network security Computer security procedures Data security Hidden categories : All articles lacking reliable references Articles lacking reliable references from April 2012 Articles needing additional references from April 2012 All articles needing additional references All articles with unsourced statements Articles with unsourced statements from January 2016 Talk Contents About Wikipedia Français 日本 語 Polski Simple English Edit links This page was last edited on 5 July 2017, at 17 : 25. Text is available under the Creative Commons Attribution - ShareAlike License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia ® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization. About Wikipedia

Question: defense in depth strategy focus on what three areas
Answer: Physical, Technical, and Administrative