Defense in Depth
What is Defense in Depth?
A layered security strategy that uses multiple security controls at different levels so that if one control fails, others continue to provide protection.
Terms that appear alongside defense in depth
Each of these is named in at least one of the same controls as defense in depth. The number is how many controls name both.
- zero trust 4 shared controls
- firewall 4 shared controls
- vlan 3 shared controls
- microsegmentation 3 shared controls
- authentication 3 shared controls
- dnssec 3 shared controls
- gateway 3 shared controls
- owasp 3 shared controls
Frameworks that govern defense in depth
What the standards actually require on defense in depth
Requirements naming defense in depth across 6 standards, quoted from the control text.
A process shall be employed to document the security measures expected in the environment in which the product is deployed (the security context) so that the asset owner supplies what the product assumes.
iec-62443::SG-2 · Defense-in-depth measures expected in the environment →Apply defense in depth protective strategies to provide multiple layers of administrative, technical, and physical controls so that compromise of any single control does not adversely impact safety, security, or emergency preparedness functions.
NRC-73.54(f) · Defense in Depth →Design the security and privacy architectures for the system using a defense-in-depth approach that: (a) Allocates [Assignment: organization-defined controls] to [Assignment: organization-defined locations and architectural layers];
NIST800-PL-8(1) · PL-8(1) Security and Privacy Architectures | Defense in Depth →Apply multiple, layered, and complementary security controls across OT architecture so that failure of any single control does not compromise the system.
OT-ARCH-3 · Defense in Depth →Design so that the failure of one control does not compromise the whole system, for example by provisioning user privileges narrowly, using access control lists and sandboxing software to contain a vulnerability.
secure-by-design-a-guide-for-manufacturers-cisa::DT-11 · Defense in depth →The CIP must provide the information Sections III.A to III.E require and describe in detail the owner/operator's defense-in-depth plan, including physical and logical security controls, for meeting each of those requirements (Critical Cyber System identificati...
tsa-pipeline-cybersecurity-directives::SD02-II.B.1 · SD02 II.B.1 CIP content: defense-in-depth plan for Sections III.A to III.E →Questions people ask about defense in depth
What is Defense in Depth?
Why is Defense in Depth important for compliance?
Which compliance frameworks address Defense in Depth?
Where can I learn more about Defense in Depth?
See how Defense in Depth applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.