Defense in Depth: Expert insights on building a multi-layered cybersecurity strategy

For organisations, amongst a backdrop of increasing cyber threats and regulations, having deep layers of cyber security is no longer aspirational – it is now essential. As a result, the concept of Defense in Depth has never been more relevant.

Previously, we sat down with seasoned cybersecurity expert – David Clarke – to explore the changing behaviours towards encrypted storage, and to get his thoughts on the NIS2 Directive and the Digital Operational Resilience Act (DORA) and their implications.

On this occasion, we speak with David to get his insights on Defense in Depth, its concept, and what organisations should be striving for, as they aim to implement a layered and robust cyber security strategy.

Clarke’s vast experience includes leading the security for the world’s largest financial trading networks and managing one of Europe’s biggest security operation functions. Here is an overview of his key observations – along with the full video from this insightful interview.

The concept of Defense in Depth

Defense in Depth is a multi-layered approach to security that aims to protect information by implementing several layers of defence. Clarke explains that this concept has been around for centuries, dating back to ancient times when castles were built with multiple layers of protection, such as moats and walls. Yet today, this translates to various security measures that work with one another to protect an organisation’s data and systems.

Vulnerability & risk management

One of the critical aspects of Defense in Depth is vulnerability management. Clarke highlights the importance of regularly patching vulnerabilities to prevent exploitation. He shares an example from his experience in the financial sector:

We had an environment where you weren’t allowed more than 24 seconds outage a year or more than two seconds in a single month. So, you have to design the environment so you can patch parts of it, while the other parts are operational.

This approach ensures that vulnerabilities are consistently addressed – and promptly, without disrupting business operations.

As part of vulnerability management, conducting effective risk assessments while also implementing mitigation efforts are key measures in achieving a robust Defense in Depth strategy.

Regular risk assessments enable organisations to identify and understand their vulnerabilities, allowing them to prioritise their mitigation efforts accordingly. Additionally, by integrating risk assessment and mitigation efforts into the broader vulnerability management process, it ensures that organisations can proactively manage risks and enhance their resilience against cyber threats.

Importance of multiple layers

Clarke emphasises that relying on a single security measure is insufficient. For example, depending solely on one firewall can leave an organisation vulnerable to attacks. Instead, by having multiple layers, such as different vendors’ firewalls, it can help mitigate the risk of a single point of failure. This approach ensures that if one layer is compromised, there are others that remain operational to protect the system or process.

Managing super users

Super users, or individuals with elevated access privileges, pose a significant risk if they are compromised. Clarke explains:

Once you compromise that super user, logs are turned off, logs are deleted, data is exfiltrated, and you don’t even know. But if you had multiple access points, especially for super users, it would make it much, much tougher to get that level of compromise.

Clarke goes on to advocate the implementation of stricter controls for super user accounts, such as time-limited access and multiple layers of authentication. This minimises the risk of unauthorised access and ensures that any potential compromise is quickly detected and mitigated.

Employee training and security hygiene

Employee training is a vital component of a robust Defense in Depth strategy. Clarke stresses the importance of educating employees on recognising and escalating potential security incidents. Implementing effective training programs as part of a broad security hygiene program can significantly decrease the time it takes to respond to incidents, reducing the impact on the organisation.

Incident response and recovery

Clarke outlines the importance of having a well-defined incident response and recovery plan. Organisations must ensure that all employees understand how to escalate suspected incidents and that key stakeholders are prepared to triage and respond effectively. Quick and efficient incident response is key for minimising damage and ensuring a swift recovery.