Defence in depth is the architectural principle that the Security Consulting function must advocate as the foundational philosophy for every significant security architecture engagement, because it embodies the most important insight that the security consulting discipline brings to the organisation’s technology protection decisions: that the single security control, however comprehensive its design and however well its implementation reflects the current state of the art, will eventually fail to prevent the determined and sophisticated adversary whose resources and persistence the modern threat landscape makes the baseline assumption for the organisation’s most consequential risk scenarios. The question that the Security Consulting function must govern is not whether to rely on a single control or a layered architecture but how to design the layered architecture whose multiple independent barriers create the redundancy, the complexity for attackers, and the comprehensive coverage that the organisation’s risk profile requires.
The Security Consulting function’s role in advocating and designing the layered security architecture is to bring the strategic architectural perspective that ensures the layers are genuinely independent, genuinely complementary, and genuinely proportionate to the asset criticality and threat profile that the risk analysis has established, rather than the additive accumulation of controls whose layers overlap without the genuine independence that defence in depth requires or whose coverage gaps leave the critical assets unprotected despite the control count that the layer inventory suggests is comprehensive.
The Strategic Value of the Layered Approach #
The strategic case for the defence in depth architecture that the Security Consulting function must make to the business and executive audiences whose investment decisions determine the security architecture’s quality rests on four governance propositions that together provide the business justification that the security investment case demands.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
