Defense in Depth

1Defense in Depth Layers:
2 
3┌─────────────────────────────────────────────────────────────┐
4│                    PHYSICAL SECURITY                        │
5│  Guards, Badges, Locks, Cameras, Fences                     │
6├─────────────────────────────────────────────────────────────┤
7│                    PERIMETER SECURITY                       │
8│  Firewalls, IDS/IPS, DMZ, VPN, WAF                         │
9├─────────────────────────────────────────────────────────────┤
10│                    NETWORK SECURITY                         │
11│  Segmentation, VLANs, NAC, Network Monitoring              │
12├─────────────────────────────────────────────────────────────┤
13│                    ENDPOINT SECURITY                        │
14│  Antivirus, EDR, Host Firewall, Patch Management           │
15├─────────────────────────────────────────────────────────────┤
16│                    APPLICATION SECURITY                     │
17│  Input Validation, Authentication, Encryption              │
18├─────────────────────────────────────────────────────────────┤
19│                    DATA SECURITY                            │
20│  Encryption, DLP, Access Controls, Backups                 │
21├─────────────────────────────────────────────────────────────┤
22│                    POLICIES & PROCEDURES                    │
23│  Security Training, Incident Response, Compliance          │
24└─────────────────────────────────────────────────────────────┘
25 
26Each layer is a barrier. Attackers must defeat ALL to reach data.

1The Cyber Kill Chain:
2 
31. RECONNAISSANCE
4   └── Attacker gathers info (OSINT, scanning)
5   └── Defense: Minimize public info, detect scans
6 
72. WEAPONIZATION
8   └── Attacker creates malware/exploit
9   └── Defense: Threat intelligence, understand TTPs
10 
113. DELIVERY
12   └── Attacker sends payload (email, USB, web)
13   └── Defense: Email filtering, web proxy, USB controls
14 
154. EXPLOITATION
16   └── Vulnerability is triggered
17   └── Defense: Patching, hardening, EDR
18 
195. INSTALLATION
20   └── Malware establishes persistence
21   └── Defense: Application whitelisting, monitoring
22 
236. COMMAND & CONTROL (C2)
24   └── Attacker establishes communication
25   └── Defense: DNS monitoring, proxy logs, outbound filtering
26 
277. ACTIONS ON OBJECTIVES
28   └── Attacker achieves goal (data theft, ransomware)
29   └── Defense: DLP, encryption, backups, monitoring
30 
31606070;">#a5d6ff;">"Break the chain at ANY point = attack stopped"

1MITRE ATT&CK Tactics (Attack Phases):
2 
3┌────────────────────────────────────────────────────────────────┐
4│  Tactic            │  What Attacker is Doing                  │
5├────────────────────┼────────────────────────────────────────────┤
6│  Reconnaissance    │  Gathering information about target       │
7│  Resource Dev.     │  Setting up infrastructure                │
8│  Initial Access    │  Getting into the network                 │
9│  Execution         │  Running malicious code                   │
10│  Persistence       │  Maintaining access after reboot         │
11│  Privilege Esc.    │  Getting higher permissions              │
12│  Defense Evasion   │  Avoiding detection                      │
13│  Credential Access │  Stealing passwords/tokens               │
14│  Discovery         │  Learning about the environment          │
15│  Lateral Movement  │  Moving to other systems                 │
16│  Collection        │  Gathering data to steal                 │
17│  Exfiltration      │  Stealing data out                       │
18│  Impact            │  Destroying/encrypting data              │
19└────────────────────┴────────────────────────────────────────────┘
20 
21Each tactic contains TECHNIQUES (specific methods)
22Each technique has PROCEDURES (exact implementations)

1How Defenders Use MITRE ATT&CK:
2 
31. DETECTION MAPPING
4   - Map your detection rules to ATT&CK techniques
5   - Identify gaps in your coverage
6   - Example: 606070;">#a5d6ff;">"Do we detect T1059 (Command & Scripting Interpreter)?"
7 
82. THREAT INTELLIGENCE
9   - Map threat actor TTPs to ATT&CK
10   - Know which techniques APT groups use
11   - Prioritize defenses against relevant threats
12 
133. RED TEAM / PURPLE TEAM
14   - Structure tests around ATT&CK techniques
15   - Validate detection capabilities
16   - Measure improvement over time
17 
184. INCIDENT RESPONSE
19   - Categorize attacker activity
20   - Common language across teams
21   - Predict next moves based on known patterns
22 
23Website: https:606070;">//attack.mitre.org/

1Security Controls by Function:
2 
3PREVENTIVE (Stop attacks before they happen)
4├── Firewalls - Block unauthorized traffic
5├── Access Control - Limit who can access what
6├── Encryption - Protect data in transit/at rest
7├── Patching - Remove vulnerabilities
8└── Training - Prevent human errors
9 
10DETECTIVE (Identify attacks in progress)
11├── IDS/IPS - Detect malicious traffic
12├── SIEM - Correlate security events
13├── EDR - Monitor endpoint behavior
14├── Log Analysis - Find suspicious patterns
15└── File Integrity Monitoring - Detect changes
16 
17CORRECTIVE (Fix problems after detection)
18├── Incident Response - Contain and remediate
19├── Backup & Recovery - Restore from attacks
20├── Patch Management - Fix vulnerabilities
21└── Antivirus Quarantine - Isolate malware
22 
23DETERRENT (Discourage attacks)
24├── Warning Banners - Legal notices
25├── Security Cameras - Visible surveillance
26├── Threat of Prosecution - Legal consequences
27└── Visible Security Team - Shows preparedness
28 
29COMPENSATING (Alternative when primary control fails)
30├── Monitoring old system that can't be patched
31├── Network isolation for vulnerable device
32└── Additional logging when prevention isn't possible

1Defense in Depth Against Phishing:
2 
3LAYER 1: Email Gateway
4├── Block known malicious senders (IP reputation)
5├── Scan attachments for malware
6├── Check URLs against threat intelligence
7├── SPF/DKIM/DMARC validation
8└── Sandboxing suspicious attachments
9 
10LAYER 2: User Training (The Human Firewall)
11├── Phishing awareness training
12├── Simulated phishing campaigns
13├── Clear reporting process
14└── Reward for reporting
15 
16LAYER 3: Endpoint Protection
17├── EDR detects malicious behavior
18├── Application whitelisting
19├── Macro blocking in Office
20└── Browser isolation
21 
22LAYER 4: Network Controls
23├── Web proxy blocks malicious domains
24├── DNS filtering
25├── Network segmentation
26└── Outbound traffic monitoring
27 
28LAYER 5: Identity & Access
29├── MFA prevents credential use
30├── Conditional access policies
31├── Privileged access management
32└── Session monitoring
33 
34LAYER 6: Data Protection
35├── DLP prevents data exfiltration
36├── File encryption
37├── Access logging
38└── Backup systems
39 
40Result: Even if user clicks link, multiple layers can still stop attack!

1Assume Breach Principles:
2 
31. LIMIT BLAST RADIUS
4   - Network segmentation
5   - Least privilege access
6   - Separate admin accounts
7   - Microsegmentation
8 
92. DETECT QUICKLY
10   - Continuous monitoring
11   - Behavioral analytics
12   - Threat hunting
13   - Honeypots and deception
14 
153. RESPOND RAPIDLY
16   - Incident response plan
17   - Automated containment
18   - Forensic readiness
19   - Communication plans
20 
214. RECOVER RESILIENTLY
22   - Tested backups
23   - Disaster recovery
24   - Business continuity
25   - Lessons learned process
26 
27"It's not about preventing every attack.
28 It's about detecting fast and limiting damage."

What is the main principle behind Defense in Depth?

Think about a home network. List at least 5 different security layers you could implement, categorizing each as preventive, detective, or corrective.