Defense in Depth

The concept originated in military strategy, where barriers impede intruders while defenders monitor their progress and respond. In cybersecurity, defense in depth means detective and protective measures that impede an intruder while the organization detects and responds to the intrusion, with the goal of reducing the consequences of a breach.

Defense in depth is not a one-to-one exercise of deploying a specific technology against each risk. It protects all assets, accounts for their interconnections and dependencies, and provides layers of monitoring and protection based on the organization's exposure to risk. CISA's defense-in-depth planning model for industrial control systems includes physical controls, perimeter defenses and monitoring, internal defenses, policies and procedures, training, situational awareness, and supply chain security.

In CISA's guidance for industrial control systems, layered defenses raise the cost of an intrusion and improve the probability of detection. The same guidance states that they do not and cannot protect every vulnerability and weakness. Their main purpose is to slow an attacker down enough for staff to detect and respond, or to make the attack so cumbersome that the attacker turns to an easier target.