What is “Defense in Depth” and How Will it Help Me Protect My Organization?

Threat actors have become more and more sophisticated in the way that attack organizations and as such, your defenses need to evolve as well.  The generally accepted practice for defending your organization against different types of attacks is called Defense in Depth.  Using this approach, you layer different protective controls throughout your organization in order to prevent attacks that come in through different methods and utilize technology to detect them quickly if they do manage to penetrate limiting the damage that they can do to your network and your data.

Some common controls for this layered approach include:

• Multi Factor Authentication – Something you know such as your user name and password and something you have such as your cell phone or a token that displays unique codes required when you log in to an application or your network.
• Web/DNS Filtering – This control will limit the places that your employees can go on the internet and stop them from going to “known bad” locations and sites that have been compromised.
• Strong Password Policies – When you create a password for your log in, it should be long and complex making it more difficult for an attacker to guess or crack with a password cracking tool.
• Next Generation Antivirus – Traditional antivirus software simply looks for signatures of known viruses.  Next Generation antivirus using artificial intelligence to looks for patterns of behaviors that threat actors commonly user to infiltrate your network.
• Email Mailbox Monitoring – Email takeover is one of the most common types of attacks to steal your data and intercept your financial transactions.  You should monitor your email mailboxes for common threat behaviors such as new email forwarding rules and unusual login activity.
• Network Monitoring for Advanced Persistent Threats – Watching the activity that is happening within your network will quickly identify behavior such as lateral movement (moving from workstation to workstation) commonly used in ransomware attacks so you can stop it before they get too far.

These are all in addition to having an up to date Next Generation Firewall, regular security patching, and vulnerability assessments which should be done simply to keep the major known threats at bay.

By employing this type of strategy it will greatly increase your security posture and help keep threat actors at bay.  While there is no 100% way to ensure that an attack will not happen, by employing Defense in Depth you will make it very difficult for a threat actor to infiltrate your network encouraging them to move on to somewhere else that is not employing a complete security program such as this.