A critical concept in the world of I.T. Security is defense in depth or layered security.
Now before we get into this too much I want to make sure we're incredibly comfortable with a particular
set of terms and that is diversity versus redundancy.
So to help us out here I'm going to go back to World War One Better World War One you had these trench
systems out there now with these trench systems.
You didn't have just one trench you'd have a lot of trenches two or three or four or five trenches in
that particular case what you're talking about is redundancy with redundancy.
We have applied some type of security control over and over again almost always in some form of layered
fashion.
Now diversity is a different animal altogether in diversity what we're talking about is bringing a different
type of control into play.
So sticking with that will we're one analogy instead of just having trenches.
I'd also put in barbed wire or machine gun posts or something like that.
Totally different types of controls to prevent the bad guys from coming across No Man's Land and taking
over.
And sorry about it.
That's right now as lots of really great stuff were war one was 100 years ago so I'm watching all that.
It's on my mind.
So now that we're comfortable with the difference of diversity versus redundancy Let's take a look at
this a little bit.
Now what I'd like to start off with is here's an example of a single computer sitting in my office somewhere.
And what I want to do is I want to protect protect that from malware.
So what can I do.
Well I can install multiple redundant layers of security for example I can put anti-malware directly
on the system itself.
I can set up network based intrusion detection to see if I can find malware that way I can put malware
on access control lists within my firewall.
I can put anti-malware in a lot of different places and provide a lot of layers to protect that one
system there in the middle.
Now diversity is a little bit of a different animal.
So with diversity here total seminars I only have one Internet service provider and that Internet service
providers the popular dosis Comcast which a lot of people have these days.
Now I want to give myself some defense in depth here.
So would I go out and just go get another Comcast system.
No.
What I want to do is I want to be diverse in this case so what I'm going to do is I'm going to keep
my Comcast system.
But I'm also going to go again another provider here down in southern Texas AT&T who would provide me
a completely different Internet service provider service in case anything were to ever go wrong.
So that would be a great example of classic diversity when it comes to Internet service providers.
So we do this a lot when it comes to diversity so we're always thinking about different things like
this.
Example what I just gave you there is what we would call vendor diversity in that particular case I
didn't stick with just Comcast.
I use two different vendors to provide my internet service provider and by the way we can do this with
just about anything we could to have diversity and routers diversity in operating systems almost anything
we want.
So when we talk about diversity we tend to think about the physical administrative and technical control
thing.
So when you think about those three things we want to make sure that we have different types of controls
on any particular situation where we want to have defense and depth.
One great example would be I don't want people logging into computers at certain times.
So one of the things I could do is I can set up a technical control that I can configure my Windows
server so they can only log in between this time and that time.
But I could also make an administrative control in this case and by setting up an administrative control
I can basically just assign people to different shifts and then that way they're never really going
to run into each other.
So two very different controls achieving the exact same thing.
Another great example I could do is let's say I don't want people using Facebook during company time.
So in this particular case well I could set up a technical control and basically block Facebook dotcom
right at my firewall but I could also do an administrative control and in this particular case I could
set up an acceptable use policy that says Ye shall not use social media during business hours and in
that case once again I've got two very very diverse types of security controls achieving the same job.
So when we're talking about defense and depth it's great to think about the layers the layers are important
but also remember whenever we're doing good defense in depth you have good diversity.