reciprocity.com Open in urlscan Pro
2606:4700::6812:56f  Public Scan

Form analysis
3 forms found in the DOM

GET /

<form role="search" action="/" method="get" id="searchform" class="custom-form__wrapper d-block d-lg-none">
  <div class="custom-form custom-form--hide">
    <input type="text" class="custom-form__input custom-form__input--mobile" placeholder="Search" value="" name="s" id="search-mobile">
    <button class="custom-form__submit" disabled=""><i class="far fa-search" aria-hidden="true"></i></button>
    <ul id="entry_departments"></ul>
  </div>
</form>

GET /

<form role="search" action="/" method="get" id="searchform" class="custom-form__wrapper d-none d-xl-none">
  <div class="custom-form">
    <input type="text" class="custom-form__input" onfocus="this.placeholder = 'Search'" onblur="this.placeholder = ''" placeholder="" value="" name="s" id="s">
    <button class="custom-form__submit" disabled=""><i class="far fa-search" aria-hidden="true"></i></button>
    <ul id="entry_departments"></ul>
  </div>
</form>

GET /

<form role="search" action="/" method="get" id="searchform" class="custom-form__wrapper d-none d-lg-block">
  <div class="custom-form custom-form--hide">
    <input type="text" class="header__outside-input" placeholder="Search" value="" name="s" id="s">
    <button class="header__outside-button"><i class="far fa-search" aria-hidden="true"></i></button>
    <ul id="entry_departments"></ul>
  </div>
</form>

Text Content

 * Product
    * ROAR Platform
    * ZenComply
    * ZenRisk
    * ZenGRC Platform
    * Risk Intellect
    * Pricing

 * Solutions
    * By Industry
    * By Framework
   
    * Technology
    * Financial Services
    * Hospitality
    * Healthcare
    * Government
    * Education
    * Retail
    * Media
    * Insurance
    * Manufacturing
    * Oil & Gas
   
    * Popular
      * ISO
      * PCI
      * SOC
      * COSO
      * SSAE 18
    * Privacy
      * CCPA
      * GDPR
    * Health Care
      * HIPAA
    * Government
      * NIST
      * FedRAMP
      * FERPA
      * CMMC
      * FISMA
    * Finance
      * SOX
      * COBIT

 * Success
    * GRC Experts
    * Customer Success
    * Services

 * Resources
    * Resource Center
    * Reciprocity Community
    * Newsroom
    * Events
    * Blog
    * Customer Stories
    * Content Registry

 * Company
    * About Us
    * Contact Us
    * Careers
    * Leadership
    * Trust Center
    * Partners

Try it free

Get a Demo Try it free



YOUR GUIDE TO DEFENSE IN DEPTH

Published April 26, 2022 • By Reciprocity • 5 min read
TwitterFacebookLinkedInCopy Link

Modern cybersecurity requires a multi-layered approach to detecting and
repelling threats. Emerging cyber risks can adapt to your initial firewalls or
encryptions, so having more than one layer of defense helps to thwart these bad
players. This type of cybersecurity strategy is called Defense in Depth.

In this guide we’ll walk you through everything you need to know about Defense
in Depth, defining key terms and security measures along the way.


WHAT IS DEFENSE IN DEPTH (DID)?

Defense in Depth takes its name from a military strategy that focuses on slowing
down an attack by putting several obstacles in the enemy’s way, rather than
relying on a single, strong defensive line. Once the enemy is drawn into the
layers of defense, the defense can better analyze the enemy’s weaknesses while
continuing to fight. Eventually this wears down the enemy so the defensive side
can counter-attack.

Defense in Depth for cybersecurity borrows from this ideology as well, using
multi-level security controls to keep your organization safe from potential
cyber threats. The intent is that if one defense strategy fails, then another
defense strategy will block an attacker. Information security teams use DiD when
putting together cyber risk management protocols, planning for data breaches or
malware at each level of defense.

Defense in Depth is important because it creates multiple barriers a cyber
attacker must penetrate before reaching your protected information. Threats can
therefore be better understood, and your organization’s cybersecurity strategy
will improve by seeing which defense strategies are most effective within your
DiD.


HOW DOES DEFENSE IN DEPTH WORK?

DiD relies on redundancies to block cybersecurity breaches from compromising
your sensitive information. For example, if a cyber attacker breaches your
firewall, your authentication controls could slow down the attacker while your
information security team works in real time to better understand the attacker
and how to stop it.

Antivirus programs are another example: They provide intrusion detection against
potential threats, catching the threats and alerting your information security
team to the attempts at infiltration.

These layers of security allow for regular re-evaluation of your information
technology team’s cybersecurity protocols and the much-needed updates that come
with understanding developing cyber risks.


USE CASES FOR DEFENSE IN DEPTH


END-USER SECURITY

End-user security protocols should be your first layer of DiD. Keep your key
stakeholders apprised of security controls and security best practices via
training and published policies; that will reduce the number of internal
breaches. Assure that staff (or any other endpoint users) use authentication to
access protected information; that is another layer, and one made even more
effective if you require those login credentials to be changed regularly.

Antivirus software is a simple security strategy that you can assign to endpoint
users. It’s best to keep the antivirus program installed on all PCs and laptops
that access your organization’s protected information regardless of the devices’
physical location; this assures constant monitoring for malware and ransomware
viruses.


NETWORK SECURITY

Think of network security as the DiD layer most closely associated with physical
security. All on-site electronics, systems, and servers should use firewalls,
virtual private networks (VPNs), and VLANs.

This category should also include intrusion detection and prevention, another
layer of security associated with traditional IT systems onsite.


THE ARCHITECTURE OF A DEFENSE IN DEPTH PLAN

A good Defense in Depth plan will have a multi-part architecture consisting of
layering security controls. These include:


NETWORK SECURITY CONTROLS

Network security controls assure the privacy and security of the network systems
within your organization. Examples include authentication, passwords, login
credentials, and access controls. Another example of network security is
encryption, where users cannot understand or parse the data until they log in
(with proper authentication) to see the decrypted version.


WEBSITE PROTECTIONS

Protecting your organization’s website is another simple yet effective layer of
security within your DiD architecture. An unprotected website can result in a
denial-of-service (DoS) attack or the exposure of customer personally
identifiable information (PII).

One way of protecting your website is to scan and monitor for cyber threats
continuously. Integrating a customizable cybersecurity dashboard into your
company’s strategy can help you to monitor developing threats while indexing
regular scans.

Another way to protect your website: require accounts and login credentials.
This creates an audit trail of which users access what information, and blocks
unauthorized users from gaining access to critical systems. Yes, account IDs and
passwords can be stolen – but no single defense layer is perfect. All defense
layers, however, can slow down or reduce the threat of attackers.


ADMINISTRATIVE CONTROLS

Administrative controls are those controls used by more senior employees (that
is, the administrators) to manage your IT systems as a whole. For example,
administrators might have the power to create new user accounts or close old
ones; or to amend IT controls to require additional layers of authentication.
They might also update policies, require new training, or impose other duties on
fellow employees.

Administrative access should be tightly controlled. For example, all employees
accessing data systems from remote locations might be required to use a VPN or
multi-factor authentication – but administrators might be required to do the
same for every instance of logging onto IT systems, even if they are using
on-premises equipment. Likewise, changes to authentication protocols might be
required to have two separate administrators approve the change.

Used wisely, however, administrative controls can enact security changes across
a broad range of the enterprise quickly and efficiently. So treat administrative
controls as the powerful tools that they are: carefully.


PERIMETER DEFENSES

Think of a perimeter defense as drawing boundaries around your digital presence
to secure that initial point of contact for any potential threats. In many
cases, your perimeter will include all connections to the internet within your
organization, as well as any connections to software-as-a-service (SaaS)
systems. Securing these attack vectors provides a strong layer of security
within your DiD architecture.


ADVANTAGES & DISADVANTAGES TO DEFENSE IN DEPTH STRATEGIES

As with any cybersecurity strategy, Defense in Depth has its pros and cons.

The greatest advantage of Defense in Depth is that it protects against a single
point of failure leaving your entire IT environment exposed to attackers. With
multiple layers to cut through, your team will have time to analyze how to best
stop a cyberattack before it reaches the heart of your organization.

On the other hand, DiD architecture is complex. It requires a considerable
allocation of financial and talent resources to implement, maintain, and
reinforce the multi-layer security system. In short: it’s expensive and
time-consuming.

One way to counter the intensity required for successful DiD security measures
is to integrate a cybersecurity dashboard that allows you technical controls,
information assurance, and an improved understanding of the lifecycle of your
depth approach.


MAKE RECIPROCITY ROAR PART OF YOUR MULTI-LAYERED CYBERSECURITY PLAN

Reciprocity ROAR specializes in security products that make it simple for you to
monitor all information systems within your layers of security.

You can better understand developing threats and analyze attack vectors within
your organization while seamlessly maintaining all the different facets needed
for successful Defense in Depth architecture.

The Reciprocity ROAR platform and dashboard give you all the continual data you
need to maintain efficient cybersecurity over time. Regular monitoring and
shareable reports help you adapt to potential threats and efficiently update
your depth approach as needed.

Learn more about the platform and see in action! Request a demo today.


TRY RECIPROCITY COMMUNITY EDITION FOR FREE!

Sign Me Up!


LATEST ARTICLE

What Is Risk Prioritization in Project Management?


LEARN MORE

The Changing Role of the CISO [Fireside Chat]

What Are PCI DSS Standards?

What Are Risk Management Methodologies in Compliance?


GET CYBER RISK CLARITY FREE AND EASY

ROAR Platform: Try it Free
Product
 * ROAR Platform
 * ZenComply
 * ZenRisk
 * ZenGRC Platform
 * Risk Intellect
 * Pricing

Solutions
 * Industries
 * Frameworks

Success
 * GRC Experts
 * Customer Success
 * Services

Resources
 * Resource Center
 * Reciprocity Community
 * Newsroom
 * Events
 * Blog
 * Customer Stories
 * Content Registry

Company
 * About Us
 * Contact Us
 * Careers
 * Leadership
 * Trust Center
 * Partners

(877) 440-7971

Contact Us


(877) 440-7971

Contact Us


© 2022 All rights reserved

Privacy Policy
✓
Thanks for sharing!
AddToAny
More…




SUBSCRIBE NOW SO YOU DON'T MISS OUT

--------------------------------------------------------------------------------

YOU CAN TURN OFF NOTIFICATIONS AT ANY TIME FROM YOUR BROWSER

Subscribe Nope

POWERED BY SUBSCRIBERS