1. A Defense-in-Depth Strategy
Presented by Richard Gancze

2. Information Assurance
Information security
What does every Internet user who uses the web to make purchases, bank online or utilize services of an application service provider (e.g. salesforce.com) want?
Information Assurance

3. What is information assurance?
A proportional balance of
Data Confidentiality +
Data Availability +
Data Integrity =
Information assurance

4. Achieve information assurance?
Defense-in-depth strategy

5. Layers
Multiple layers of security are better than a single protection mechanism
If one layer fails there are multiple layers behind it to protect the organization
If all layers fail, then the organization must be able to react

6. Defense-in-breadth
Multiple layers of protection with different configuration mechanisms

7. 3 Key Elements
People are the first line of defense and the most important asset in an organization

8. A Defense-in-Depth implementation

9. References
Official (ISC)2 Guide to the CISSP Exam, Susan Hansche and John Berti, Chris Hare, Auerbach Publications, 2004
Security+ Certification Training Kit, Microsoft Corporation with Andy Ruth and Kurt Hudson, Microsoft Press, 2003
“Defense in Depth”, National Security Agency,