A penetration test report recommends implementing a 'defense-in-depth' strategy as a remediation for multiple findings. A junior analyst asks what this means. Which description is most accurate?
Select an answer to reveal the explanation.
Short Explanation
Defense-in-depth means you stack multiple security controls across different layers, so if one control fails, others still protect the asset. It’s not about one perfect control, ignoring less critical systems, or relying on AI alone.
Full Explanation
The correct description is implementing multiple, layered security controls across different domains so that if one control fails, additional controls continue to provide protection. Defense-in-depth, also called layered security or the Castle Approach, involves overlapping controls across network, host, application, and data layers so an attacker must defeat multiple independent controls to successfully attack an asset. The option describing a single, very strong security control is wrong because defense-in-depth is the opposite of relying on one control; it explicitly assumes any individual control can fail and prepares compensating layers. The option describing defending only the most critical systems while accepting risk on less important assets is wrong because accepting risk on lower-priority assets may be appropriate, but that is risk management, not defense-in-depth. The option describing deep learning AI to detect all attacks automatically is wrong because AI/ML detection is a single tool technology, while defense-in-depth is an architectural principle spanning technology, process, and people.