Understanding defense in depth: A comprehensive guide

What is defense in depth?

Defense in depth (DiD) is the strategy of layering different physical and digital resources to reinforce the security measures in an organization. It’s a preventative approach aiming to decrease the odds that sensitive data will be breached or stolen.

Defense in depth shares its name with a Roman military strategy. This tactic saw the Roman military taking a defensive approach rather than going after targets themselves. If the enemies reached the Roman Empire's borders, the Romans would allow them to cross. Once on their native soil, the Roman military would attack the enemy from within the border provinces. This made it more difficult for enemy forces to reach cities and cause significant damage to land.

Centuries later, this layered strategy has become what we now know as defense in depth cybersecurity. The principle is simple — an organization sets up a range of digital and physical protective barriers that discourage attackers from striking in the first place. Even if a hacker manages to crack one of the layers, they still have to face the rest of the defensive system. With enough varied layers, an organization may establish an impenetrable line of defense.

You might be eager to cut into this defensive cake and see each of its layers. So let’s take a closer look at how this approach works in practice.

Defense in depth architecture

To visualize the concept of defense in depth, you can think of concentric castles – medieval structures that were fortified with multiple inner and outer walls. Each wall added challenge to attacking forces and helped fend off threats longer. At its core, defense in depth works the same – each layer makes it more difficult to breach the system.

Defense in depth mechanisms are generally grouped into three categories:

• Administrative controls

• Physical controls

• Technical controls

Each of the categories consists of different tools and strategies. The range of tools used in defense in depth varies based on the needs and resources available to an organization. Typically, technical controls make up half the architecture, with physical and administrative controls accounting for the rest.

Administrative controls concern the procedures and policies that your company employs. This encompasses processes in practically all areas of the organizational structure. The processes of hiring and how much information is revealed to a candidate, onboarding and offboarding, and data processing regulations all contribute to administrative controls. You can also think of company-wide initiatives such as safety training or protocols that are set in place in case of a data-related incident.

Physical controls refer to a hands-on approach to security. The security guards patrolling the building, cameras installed on the premises, and the locks protecting the entrances and exits all count as physical security measures in a defense in depth infrastructure. Remember that while many attacks occur exclusively online, it doesn’t mean that someone won’t try to break in or snoop around the headquarters. Protecting your physical data storage is as crucial as the digital side.

Finally, technical controls encompass a broad range of digital tools that help ensure the protection of your sensitive information. When we talk about technical controls, we typically discuss software, although hardware storage can also be used for data storage and protection. Antivirus and anti-spyware tools, cloud storage, virtual private networks, password managers – anything that can act as an extra layer of security works.

Increase your online security

Identify breaches before they harm your business

Start Free Trial

Essential principles of the defense in depth security strategy

There’s a philosophy behind every strategy. At their core, the defense in depth principles are simple – layering different security measures to optimize the protection of a database. The more layers a system encompasses, the more discouraged malicious attackers are from striking it. If they manage to rip off one security layer, they encounter a new one deeper down.

The goal of defense in depth is to account for potential failures in all areas and minimize loss if a successful breach were to occur. While software breaches and corrupt hardware can be the culprits of a vulnerable system, the weakest link is often the employees themselves.

Negligent behavior, such as insecure file sharing, use of weak passwords, and reuse of the same login credentials for different accounts, can lead to easy targeting and subsequent damage. As such, combining the three types of defense in depth controls aims to protect the company from attackers as much as from human error.

The power of layered security in cyber defense

Despite an overlap and the tendency to use both terms interchangeably, defense in depth and layered security aren’t the same. While defense in depth is an all-encompassing structure that aims to protect the security of all crucial data in your organization, layered security is focused on using different measures to withhold a particular threat or protect one area of the organizational structure.

As you can imagine, setting up layered security or defense in depth layers is an intricate process. After all, you’re essentially building defensive walls to protect sensitive data at your company's core. It’s about finding the right people and tools for your company, dedicating your resources to keeping things running smoothly, and blocking attackers before they even strike.

Defense in depth – in practice

Hypothetically, here’s what defense in depth cybersecurity infrastructure can look like in an organization:

• The physical headquarters of a company are patrolled by on-site security 24/7.

• Each employee is issued a unique keycard to access the premises.

• All employee accounts are protected by login credentials.

• All passwords are changed at regular intervals according to company policy.

• All employees must use a password manager and enable two-factor authentication.

• Remote employees connect to the company’s virtual private network to avoid using insecure public Wi-Fi.

• All computers are equipped with antivirus software.

• All operating systems and software must be kept up to date.

• All employees should complete digital safety training.

• The company should undergo regular auditing to ensure all security measures are in place.

• All sensitive company and client data must be stored in secure servers.

• A dedicated team should have an established action plan in case of a data breach.

• A support team should be on call in case of an emergency.

Notice which of these measures fall under technical, administrative, and physical controls. As you implement your own strategy, you’ll see that, in some instances, the strategies and tools overlap and support each other, reinforcing the effectiveness of your layered defense mechanism.

Best practices of defense in depth implementation

The key tip for maintaining a successful defense in depth approach is keeping everything up to date. After all, cyber crooks are working on new strategies and tools to get past your defenses, and you want to ensure you stay ahead of the threats.

Ensure that all software you’re using is regularly updated. Outdated software often contains security gaps that hackers can exploit, so make sure the patches are installed. This also goes for online platforms – if services you rely on are breached or become obsolete, you need to relocate your data securely.

Don’t forget hardware – have an action plan if your devices are damaged or stolen. The same goes for in-house security and measures like setting up protocols in case an employee’s or guest’s entrance card is stolen or lost.

Of course, updating your own knowledge is essential. Hold regular training sessions, follow the latest data breach news, keep yourself informed about lurking threats, and learn the strategies that you can implement to fend off the attacks.

How NordPass can help

As we’ve seen, the technical layer holds the most weight in a successfully resilient defense in depth structure. That means amping up your technical toolkit is priority number one for your organization. Improving the company’s password protection is not something to overlook.

Human error is among the leading causes of data breaches. Whether it’s negligence, bad password management, or malicious intent, humans are usually at fault. As such, organizations need to work on policies and tools to reduce the risk of incidents caused by employees. Despite the growing popularity of passkeys, passwords are still the most common security tool that each member of the organization relies on, making them equally vulnerable and valuable.

Here’s where NordPass comes in. As a business-optimized password manager, it helps you keep all of your organization’s sensitive information secure, whether it’s login credentials, company bank accounts, or client information. With NordPass, you can create, store, and manage strong passwords that are difficult to crack. Two-factor authentication ensures that you’re the only one who can access your password vault.

Secure password sharing can often be a point of contention because people use the easy yet insecure option to pass along login credentials via email, non-encrypted messages, or Post-It notes. NordPass password manager for IT teams eliminates this risk, allowing you to share your saved items with your colleagues in-app securely. Additionally, administrators can set up company-wide password policies that require all employees to update their passwords at regular intervals, bringing the best practices of technical and administrative controls into one.

Bottom line

Setting up defense in depth for your organization might take some time, but the rewards are long term – you can rest assured that your sensitive data is under lock and key and incredibly difficult for unwanted actors to access.

If you’re unsure where to start, setting up NordPass for your organization is the perfect first step. Have your team follow secure password practices and keep their credentials updated. You won’t have to worry about coming up with new, unique ideas for each reset – simply use our Password Generator and autofill the details whenever you log in to an account. There’s no easier way to start building the defense walls around your data.