Te

 CYBERSECURITY: DEFENSE IN DEPTH

 NIGC Tech Alert 

Defense in Depth --some�me referred to as the “castle approach” because it mirrors the layered defenses of a medieval castle

-- is a strategic approach to cybersecurity that incorporates a progression of layered defensive mechanisms to safeguard data, 

informa�on, and informa�on systems from successful atacks. Recent cyber-atacks against large organiza�ons across both 

government and private sectors remind us that having a mul�-layered approach with deliberately structured redundancies 

significantly increases the security of a system. The variable barriers and countermeasures of such systems address different 

atack vectors. Companies, governments, and organiza�ons are increasingly technology dependent. Cyber related atacks

impact organiza�ons, big and small, have increased in recent years, and are not going away. To significantly reduce risk to IT 

systems, it is prudent for organiza�ons to employ a layered, redundant approach to cybersecurity. 

Within the Defense in Depth method to achieve security objec�ves, there are three cri�cal control layers: physical controls, 

technical controls, and administra�ve controls. Physical controls are defense in depth layers implemented to prevent an 

atacker from gaining physical access into an organiza�on’s IT network. They are tradi�onal protec�ons that can be used for 

anything, from access to the organiza�on’s physical site, to protec�on from specific secured rooms inside an organiza�on. 

Examples include, but are not limited to, CCTV systems, reinforced fences, and security guards. Technical controls (logical 

controls) are so�ware and hardware meant to protect an enterprise’s system and data assets. They differ from physical 

controls in the sense that they protect the data of a system rather than the physical system itself. Examples include an�virus 

so�ware, so�ware or hardware firewalls, disk encryp�on, authen�ca�on controls, and Mul�-Factor Authen�ca�on. Finally, 

the concept of administra�ve controls refers to an organiza�on’s IT security policies and procedures. The purpose of this 

layer of defense is to provide appropriate cybersecurity guidance and to ensure IT regula�ons are adhered to. Examples 

include security requirements, data handling procedures, digital code of conduct, confiden�ality policies, etc.

The concept of Defense in Depth is not new. Many organiza�ons already employ many of the Defense-in-Depth measures 

within their IT infrastructure, but some do not apply it across the en�re organiza�on. The defense in depth security 

architecture can help mi�gate, but not eliminate cyber risk. 

Should assistance be necessary regarding Defense in Depth principles and techniques to reduce the risk of cyber-atack, 

please reach out to NIGC. The NIGC offers technical assistance, training courses, IT audits and other tools and resources.

For minimum internal control standards, please find the NIGC IT Audit 25 CFR 543.20 Toolkit at

htps://www.nigc.gov/images/uploads/training/Toolkit_ITAudit_Rev12_4.pdf

Addi�onal resources detailing informa�on on Defense-In-Depth and related cybersecurity strategies can be found here:

htps://csrc.nist.gov/glossary/term/defense_in_depth

Please view the CISA The Department of Homeland Security (DHS)’s Na�onal Cybersecurity and Communica�ons Integra�on 

Center (NCCIC) document at 

htps://www.cisa.gov/sites/default/files/recommended_prac�ces/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

 

September 2023