Defense in depth - Revision history

Schattenbaum: Added a link to social engineering

2015-08-14T09:15:36Z

Added a link to social engineering

Shady: link works

2013-05-12T18:02:39Z

link works

KirstenS at 12:28, 7 April 2009

2009-04-07T12:28:05Z

Dvhnet: Updated the link to teh NSA's Defense In Depth Guide

2009-03-11T23:23:17Z

Updated the link to teh NSA's Defense In Depth Guide

KirstenS at 01:46, 8 March 2009

2009-03-08T01:46:50Z

KirstenS: /* References */

2009-03-04T17:53:21Z

‎References

KirstenS: /* Related Vulnerabilities */

2008-09-09T22:31:32Z

‎Related Vulnerabilities

KirstenS at 18:37, 5 September 2008

2008-09-05T18:37:26Z

KirstenS: /* Related Controls */

2008-08-01T23:50:30Z

‎Related Controls

Cduffey346: Changed redundant security controls to layered, removed section in description about the first security mechanism being 100% effective and replaced it with an example regarding 2-factor authentication

2008-06-08T20:07:04Z

Changed redundant security controls to layered, removed section in description about the first security mechanism being 100% effective and replaced it with an example regarding 2-factor authentication

@@ Line 8: / Line 8: @@
 ==Description==
-The principle of defense-in-depth is that layered security mechanisms increase security of the system as a whole. If an attack causes one security mechanism to fail, other mechanisms may still provide the necessary security to protect the system. For example, it is not a good idea to totally rely on a firewall to provide security for an internal-use-only application, as firewalls can usually be circumvented by a determined attacker (even if it requires a physical attack or a social engineering attack of some sort). Other security mechanisms should be added to complement the protection that a firewall affords (e.g., surveillance cameras, and security awareness training) that address different attack vectors.
+The principle of defense-in-depth is that layered security mechanisms increase security of the system as a whole. If an attack causes one security mechanism to fail, other mechanisms may still provide the necessary security to protect the system. For example, it is not a good idea to totally rely on a firewall to provide security for an internal-use-only application, as firewalls can usually be circumvented by a determined attacker (even if it requires a physical attack or a [[Social_Engineering|social engineering]] attack of some sort). Other security mechanisms should be added to complement the protection that a firewall affords (e.g., surveillance cameras, and security awareness training) that address different attack vectors.
 Implementing a defense-in-depth strategy can add to the complexity of an application, which runs counter to the “simplicity” principle often practiced in security. That is, one could argue that adding new protection functionality adds additional complexity that might bring new risks with it. The total risk to the system needs to be weighed. For example, an application with username/password-based authentication may not benefit from increasing the required password length from eight characters to 15 characters as the added complexity may result in users writing their passwords down, thus decreasing the overall security to the system; however, adding a smart-card requirement to authenticate to the application would enhance the security of the application by adding a complementary layer to the authentication process.

@@ Line 28: / Line 28: @@
 ==References==
-* [http://www.nsa.gov/ia/_files/support/defenseindepth.pdf National Security Agency Defense In Depth Guide] [[category:FIXME|link not working]]
+* [http://www.nsa.gov/ia/_files/support/defenseindepth.pdf National Security Agency Defense In Depth Guide]
 * [[CLASP Security Principles]]
 [[Category:Principle]]

← Older revision		Revision as of 12:28, 7 April 2009
Line 4:		Line 4:
	<br>		<br>
	[[Category:OWASP ASDR Project]]		[[Category:OWASP ASDR Project]]
−	~~[[ASDR Table of Contents]]__TOC__~~

@@ Line 29: / Line 29: @@
 ==References==
-* [http://www.nsa.gov/snac/support/defenseindepth.pdf National Security Agency Defense In Depth Guide] [[category:FIXME|link not working]]
+* [http://www.nsa.gov/ia/_files/support/defenseindepth.pdf National Security Agency Defense In Depth Guide] [[category:FIXME|link not working]]
 * [[CLASP Security Principles]]
 [[Category:Principle]]

← Older revision		Revision as of 01:46, 8 March 2009
Line 22:		Line 22:
	TBD		TBD

−	~~[[Category:FIXME\|need content here]]~~

	==Related [[Controls]]==		==Related [[Controls]]==

@@ Line 20: / Line 20: @@
 ==Related [[Vulnerabilities]]==
+[[Category:FIXME|need content here]]
 ==Related [[Controls]]==

← Older revision		Revision as of 18:37, 5 September 2008
Line 2:		Line 2:

	{{Template:Stub}}		{{Template:Stub}}
		+	<br>
		+	[[Category:OWASP ASDR Project]]
		+	[[ASDR Table of Contents]]__TOC__
		+

	==Description==		==Description==

@@ Line 21: / Line 21: @@
 ==Related [[Controls]]==
-The Principle of Defense-in-Depth does not relate to a particular control or subset of controls. It is a design principle to guide the selection of controls for an application to ensure its resilience against different forms of attack, and to reducce to probability of a single-point of failure in the security of the system.
+The Principle of Defense-in-Depth does not relate to a particular control or subset of controls. It is a design principle to guide the selection of controls for an application to ensure its resilience against different forms of attack, and to reduce the probability of a single-point of failure in the security of the system.
 ==References==

@@ Line 5: / Line 5: @@
 ==Description==
-The principle of defense-in-depth is that redundant security mechanisms increase security. If one mechanism fails, perhaps the other one will still provide the necessary security. For example, it is not a good idea to rely on a firewall to provide security for an internal-use-only application, as firewalls can usually be circumvented by a determined attacker (even if it requires a physical attack or a social engineering attack of some sort).
+The principle of defense-in-depth is that layered security mechanisms increase security of the system as a whole. If an attack causes one security mechanism to fail, other mechanisms may still provide the necessary security to protect the system. For example, it is not a good idea to totally rely on a firewall to provide security for an internal-use-only application, as firewalls can usually be circumvented by a determined attacker (even if it requires a physical attack or a social engineering attack of some sort). Other security mechanisms should be added to complement the protection that a firewall affords (e.g., surveillance cameras, and security awareness training) that address different attack vectors.
 ==Examples==
@@ Line 22: / Line 21: @@
 ==Related [[Controls]]==