Which of the following best describes the concept of defense in depth in cybersecurity?

Defense in depth is a foundational cybersecurity strategy that involves implementing multiple, redundant layers of security controls throughout an information technology network. The core principle is that if one security layer fails or is bypassed by an attacker, another layer is in place to prevent or delay the intrusion. This approach combines administrative, technical, and physical security measures to protect assets comprehensively. By layering diverse defenses—such as firewalls, intrusion detection systems, access controls, and encryption—an organization creates a more resilient and robust security posture, significantly increasing the effort required for an attacker to compromise the system.

B. Running regular vulnerability scans is a single, specific security activity, not the overarching strategy of layering multiple controls.

C. Implementing access controls is just one type of security mechanism that would be part of a larger defense-in-depth strategy.

D. Encrypting sensitive data is a specific technical control for confidentiality; it represents a single layer, not the entire multi-layered concept.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53, Revision 5). Appendix D, Glossary, page D-4. The document defines Defense-in-Depth as an "Information security strategy that integrates people, technology, and operations capabilities to establish variable barriers across multiple layers and dimensions of the organization." This supports the concept of using multiple layers of controls.

2. Cisco. (2023). What Is Defense in Depth?. Cisco Official Documentation. The article states, "Defense in depth is a cybersecurity approach in which multiple defensive measures are layered to protect valuable information and systems. If one layer is breached, the next layer is there to thwart the attack." This directly aligns with the chosen answer.

3. Carnegie Mellon University, Software Engineering Institute (SEI). (2018). Common Sense Guide to Mitigating Insider Threats, 5th Edition. Section 4.17, "Practice 17: Implement a defense-in-depth security posture." The guide describes the practice as "layering a set of diverse security controls... so that a failure in any single control does not leave the organization's assets and information completely unprotected." This reinforces the idea of using multiple, diverse layers for protection.