A more rigorous framework for security-in-depth

Abstract

While the concept of security-in-depth or layered security has a long history, it still lacks clear definition, hampering attempts to identify the most effective target of security enhancement. A rigorous definition of security layer enables the development of useful principles to guide security investment. Risk minimization is best achieved by strengthening the layer that may already be the most effective, and by focusing on the weakest function within that layer. Moreover, security-in-depth relies not only on generating effective layers, but also on their coherent integration with maintenance, training, protocols and policies, all aligned with management structures and culture.