What is defense in depth and how should a TA apply it?

• A. Layered security controls across people, processes, and technology to reduce risk; implement multi-layer measures and verify their effectiveness.
• B. A single firewall protects all systems.
• C. Training alone provides complete protection.
• D. Security controls should be applied only to IT systems.

Answer: (A)

Defense in depth means layering security controls so there are multiple barriers across people, processes, and technology to reduce risk. A trusted agent applies this by making sure safeguards exist at several different points so if one layer fails, others still protect assets. Think of defending a system as covering the human element, the rules and procedures, and the technical tools all at once, and ensuring they work together.

To apply it, identify the critical assets and the ways an attacker might reach them, then place overlapping controls throughout: educate people with ongoing awareness and access rights aligned to least privilege; implement solid processes such as clear policies, proper access governance, change management, and incident response; and deploy technical measures like multi-factor authentication, encryption, endpoint protection, network segmentation, robust logging and monitoring, regular backups, and a tested recovery plan. Verification is key—regular testing, audits, and drills show what’s working and what isn’t, so you can tighten gaps and adapt to evolving threats.

Relying on a single firewall, training alone, or applying controls only to IT systems misses the broader protection that defense in depth provides, because it leaves gaps in people, processes, or physical security that attackers can exploit.