A Defense-in-Depth Strategy Presented by Richard Gancze

Information Assurance Information security What does every Internet user who uses the web to make purchases, bank online or utilize services of an application service provider (e.g. salesforce.com) want? Information Assurance

What is information assurance? A proportional balance of Data Confidentiality + Data Availability + Data Integrity = Information assurance

Achieve information assurance? Defense-in-depth strategy

Layers Multiple layers of security are better than a single protection mechanism If one layer fails there are multiple layers behind it to protect the organization If all layers fail, then the organization must be able to react

Defense-in-breadth Multiple layers of protection with different configuration mechanisms

3 Key Elements People are the first line of defense and the most important asset in an organization

A Defense-in-Depth implementation

References Official (ISC)2 Guide to the CISSP Exam, Susan Hansche and John Berti, Chris Hare, Auerbach Publications, 2004 Security+ Certification Training Kit, Microsoft Corporation with Andy Ruth and Kurt Hudson, Microsoft Press, 2003 “Defense in Depth”, National Security Agency, http://www.nsa.gov/snac/support/defenseindepth.pdf