Ethical Hacking: Techniques, Tools, and Countermeasures, 4th Edition

Defense in Depth

The layered approach to security called defense in depth originated in the military, where it was seen as a way to delay—rather than prevent—an attack. As an information security tactic, defense in depth is based on the concept of layering more than one control to protect assets. These controls can be physical, administrative, or technical in design. We have looked at a variety of physical controls in this chapter, such as locks, doors, fences, gates, and barriers. Administrative controls include policies and procedures for (among other things) how you recruit, hire, manage, and fire employees. During employment, administrative controls such as least privilege, separation of duties, and rotation of duties are a few of the practices ...