Page 30 - index

“Defense in Depth”

Jeff Michael, Senior Global Solutions Architect, Hexis Cyber Solutions

Cybersecurity has become a hot button issue
across all industries.

Data breaches and cyberattacks are now the
norm, and it has left companies scrambling to
upgrade their cyber defenses and with that,
organizations have begun to look into how to build
their security “Defense in Depth.”

However, the term “Defense in Depth” has always
concerned me. Organizations often think that
defense in depth is equivalent to due diligence.

Due diligence is doing just enough to show that
you are not liable.
However, what “Defense in Depth” means to most
organizations is that they have deployed what they
believe are the strongest tools at every layer of
their network.

These layers are often the network layer, the desktop layer, and the application layer. However, it
often seems like once these tools are deployed, it only highlights yet another area where more tools
need to be placed.

What this means to the organizations is that they often spend a lot of time trying to find what they
are missing, rather than focus on danger that may be around the corner.

What most organizations fail to realize is that the battle they are fighting is not a static battle, but a
very dynamic battle. Imagine fighting an enemy that has unlimited resources.

These resources are dedicated to creating the best weapons, and training the best soldiers.

They are not focused on winning the battle, they are focused on destroying the enemy.

Destroying you may only take a few seconds because the techniques of the enemy are constantly
evolving it makes the task of attempting to protect an organization almost impossible.
This would be like any modern army today engaging warfare against an army only equipped with
World War 2 technology. No matter how great the defense is, the modern army will always win.

The best thing that organizations today can do is a combination of the following: strong policy
enforcement, strong perimeter defenses, strong endpoint defenses, automated remediation, and
very skilled malware specialists.

30 Cyber Warnings E-Magazine – October 2015 Edition
Copyright © Cyber Defense Magazine, All rights reserved worldwide