Open main menu

Defense in depth (computing)

Defense in depth (also known as Castle Approach[1] is an information assurance (IA) concept in which multiple layers of security controls (defense) are placed throughout an information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited that can cover aspects of personnel, procedural, technical and physical security for the duration of the system's life cycle.



The idea behind the defense in depth approach is to defend a system against any particular attack using several independent methods.[2] It is a layering tactic, conceived by the National Security Agency (NSA) as a comprehensive approach to information and electronic security.[3][4] Defense in depth is originally a military strategy that seeks to delay rather than prevent the advance of an attacker by yielding space to buy time.


Defense in depth can be divided into three areas: Physical, Technical, and Administrative.[5]

Physical controlsEdit

Physical controls are anything that physically limits or prevents access to IT systems. Fences, guards, dogs, and CCTV systems and the like.

Technical controlsEdit

Technical controls are hardware or software whose purpose is to protect systems and resources. Examples of technical controls would be disk encryption, fingerprint readers, and Windows Active Directory. Hardware technical controls differ from physical controls in that they prevent access to the contents of a system, but not the physical systems themselves.

Administrative controlsEdit

Administrative controls are an organization's policies and procedures. Their purpose is to ensure that there is proper guidance available in regards to security and that regulations are met. They include things such as hiring practices, data handling procedures, and security requirements.

The usage of Non-Standard Ports is not a valid means of security.


See alsoEdit


  1. ^ Simon Woodside (19 June 2016). "Defence in Depth: The medieval castle approach to internet security". Retrieved 10 December 2018.
  2. ^ Schneier on Security: Security in the Cloud
  3. ^ Defense in Depth: A practical strategy for achieving Information Assurance in today’s highly networked environments.
  4. ^ OWASP Wiki: Defense in depth[unreliable source?]
  5. ^ Stewart, James Michael; Chapple, Mike; Gibson, Darril (2015). CISSP (ISC)2 Certified Information Systems Security Professional Official Study Guide.