Defense in Depth: Expert insights on building a multi-layered cybersecurity strategy

For organisations, amongst a backdrop of increasing cyber threats and regulations, having deep layers of cyber security is no longer aspirational – it is now essential. As a result, the concept of Defense in Depth has never been more relevant.

Previously, we sat down with seasoned cybersecurity expert – David Clarke – to explore the changing behaviours towards encrypted storage, and to get his thoughts on the NIS2 Directive and the Digital Operational Resilience Act (DORA) and their implications.

On this occasion, we speak with David to get his insights on Defense in Depth, its concept, and what organisations should be striving for, as they aim to implement a layered and robust cyber security strategy.

Clarke’s vast experience includes leading the security for the world’s largest financial trading networks and managing one of Europe’s biggest security operation functions. Here is an overview of his key observations – along with the full video from this insightful interview.

The concept of Defense in Depth

Defense in Depth is a multi-layered approach to security that aims to protect information by implementing several layers of defence. Clarke explains that this concept has been around for centuries, dating back to ancient times when castles were built with multiple layers of protection, such as moats and walls. Yet today, this translates to various security measures that work with one another to protect an organisation’s data and systems.

Vulnerability & risk management

One of the critical aspects of Defense in Depth is vulnerability management. Clarke highlights the importance of regularly patching vulnerabilities to prevent exploitation. He shares an example from his experience in the financial sector:

We had an environment where you weren’t allowed more than 24 seconds outage a year or more than two seconds in a single month. So, you have to design the environment so you can patch parts of it, while the other parts are operational.

This approach ensures that vulnerabilities are consistently addressed – and promptly, without disrupting business operations.

As part of vulnerability management, conducting effective risk assessments while also implementing mitigation efforts are key measures in achieving a robust Defense in Depth strategy.

Regular risk assessments enable organisations to identify and understand their vulnerabilities, allowing them to prioritise their mitigation efforts accordingly. Additionally, by integrating risk assessment and mitigation efforts into the broader vulnerability management process, it ensures that organisations can proactively manage risks and enhance their resilience against cyber threats.

Importance of multiple layers

Clarke emphasises that relying on a single security measure is insufficient. For example, depending solely on one firewall can leave an organisation vulnerable to attacks. Instead, by having multiple layers, such as different vendors’ firewalls, it can help mitigate the risk of a single point of failure. This approach ensures that if one layer is compromised, there are others that remain operational to protect the system or process.

Managing super users

Super users, or individuals with elevated access privileges, pose a significant risk if they are compromised. Clarke explains:

Once you compromise that super user, logs are turned off, logs are deleted, data is exfiltrated, and you don’t even know. But if you had multiple access points, especially for super users, it would make it much, much tougher to get that level of compromise.

Clarke goes on to advocate the implementation of stricter controls for super user accounts, such as time-limited access and multiple layers of authentication. This minimises the risk of unauthorised access and ensures that any potential compromise is quickly detected and mitigated.

Employee training and security hygiene

Employee training is a vital component of a robust Defense in Depth strategy. Clarke stresses the importance of educating employees on recognising and escalating potential security incidents. Implementing effective training programs as part of a broad security hygiene program can significantly decrease the time it takes to respond to incidents, reducing the impact on the organisation.

Incident response and recovery

Clarke outlines the importance of having a well-defined incident response and recovery plan. Organisations must ensure that all employees understand how to escalate suspected incidents and that key stakeholders are prepared to triage and respond effectively. Quick and efficient incident response is key for minimising damage and ensuring a swift recovery.

The role of hardware-based encryption

Hardware-based encryption plays a fundamental role in any Defense in Depth strategy. Clarke points out that hardware-encrypted USB drives and external SSDs offer several advantages over their software-based counterparts. More specifically, he states:

If you’ve got software encryption that’s managed centrally, if that’s compromised, you have no encryption!

The reason that hardware-based encryption is generally more secure is because it is not susceptible to software vulnerabilities. The encryption process is handled by a dedicated secure microprocessor within the storage drive, which is isolated from the computer’s operating system. This isolation makes it much harder for malware or hackers to compromise the encryption.

Hardware-encrypted devices are also designed to be resistant against password guessing attacks. If someone attempts to guess passwords to access the drive, they can trigger a crypto-erase defence that erases the entire drive, rendering the data inaccessible. This “always-on” feature, called Brute Force password attack protection, adds an extra layer of protection against physical attacks.

In turn, hardware-encrypted storage can help organisations meet regulatory and compliance requirements and demonstrate their commitment to data security. This is particularly important for industries that handle sensitive information, such as finance, healthcare, governments, or supply chains. Kingston IronKey hardware-encrypted USBs and external SSDs, for example, offer robust hardware-based encryption, ensuring that sensitive data remains secure and compliant with industry and regulatory standards.

More specifically, Kingston IronKey D500S and Keypad 200 drives are pending FIPS 140-3 Level 3 certification, ensuring organisations can trust that their most sensitive data is safeguarded with robust military-grade encryption and protection as specified by the world’s leading security agency, NIST. For those needing high-capacity storage, the FIPS 197-certified Vault Privacy 80 External SSD drives offer up to 8TB, providing a secure solution for air-gapped backups of sensitive data.

Conclusion

Defense in Depth is an extensive approach to cybersecurity that involves many areas, including multiple layers of defence, regular vulnerability management, strict controls for super users, as well as effective employee training.

Clarke’s insights highlight the importance of this strategy in protecting organisations from evolving cyber threats, and how hardware-encrypted storage plays an important part. By implementing a comprehensive Defense in Depth approach, organisations can enhance their security posture and better safeguard their critical data and systems.

Watch Video