What is the concept of defense in depth and how is it implemented?

• A. Multiple layers of controls across people, processes, and technology to reduce risk; if one fails, others remain.
• B. Relying on a single strong firewall to secure the network.
• C. Assuming perimeter security guarantees safety.
• D. Only focusing on physical security.

Answer: (A)

Defense in depth means building security with multiple, overlapping layers rather than relying on a single control. The idea is to protect assets through a series of safeguards across people, processes, and technology so that if one line of defense fails, others still stop or slow an attack. Implementing this involves layering preventive controls (like strong authentication, least privilege, secure configurations), detective controls (logging, monitoring, anomaly detection), and responsive controls (incident response, backups, disaster recovery) across different areas such as identity, network, applications, and physical security. It also means spreading defenses across multiple locations and stages—for example, endpoint protections, network segmentation, MFA, patch management, security awareness training, and reliable backups—so no single failure leads to a breach and you have protection even when one layer is bypassed.

The best description among the choices captures this idea by outlining multiple layers of controls across people, processes, and technology to reduce risk, with other layers remaining in place if one fails. The other statements rely on a single defense (a single firewall), assume the perimeter alone guarantees safety, or focus only on physical security, which do not fit the layered approach.