Computer Security – Why Defense in Depth is the Best Approach

Posted by Timothy Platt on Nov 12, 2017


Computer Security – Why Defense in Depth is the Best Approach

Security Lock
Here on “Patch Tuesday”, we’re going to discuss an important topic that we touched on briefly last week. We believe “Defense in Depth”, as applied to computer security, is the best way to mitigate the risk of security exploits and breaches. We’re going to describe the rationale and specifics of this multi-layered approach. We recommend this approach to all our clients.

What is “Defense in Depth”?

In its simplest form, “Defense in Depth” means having multiple layers of security mechanisms, as opposed to one. For a successful security exploit to occur, all the layers of defense must be circumvented – greatly increasing the difficulty of the attack and lowering the probability of success. Why is it important to not rely on any single method of protection? Because the scope, scale, and ever changing nature of these security threats – no single product or service can cover it all. But if you combine them, your chances of success improve greatly.

Have a question? Get in contact with us now

What Does “Defense in Depth” Look Like?

Here’s a practical example of a threat: a potential malware infection – which arrives via a “phishing” email. A “phishing” email is a forged, malicious email, with the intent being to trick you into visiting a compromised web site, or otherwise exposing some private information. In this case, let’s say the email contains a link to a compromised web site that hosts a malware potentially capable of infecting your computer.

  1. Firstly, let’s hope by education and training you or your employees know what to look for in a suspicious email – training and knowledge are always the first line of defense. But on the other hand, the forgeries and convincing fake emails get more convincing every day. Also, everyone can slip up, we’re only human.
  2. Hopefully this email will be recognized by Exchange Online’s heuristics for phishing emails, and sent directly to Junk mail, where it’s rendered less effective.
  3. But, if it didn’t, and it made it into your inbox, your firewall (if it provides an anti-virus or intrusion prevention function) might block the access to the hacked website that hosts the actual vector for infection.
  4. Maybe it doesn’t – but your anti-virus program recognizes the threat and neutralizes it as it downloads and attempts to take over your machine.
  5. And lastly, maybe all those mechanisms don’t work, because the malware is very new – and an anti-virus signature doesn’t exist yet, but your machine is not vulnerable to the web hosted exploit, because it’s completely up to date on all the relevant Windows security patches.

That’s what we mean by defense in depth. There’s 5 different layers in that, all independent, that would have to be circumvented.

What are Best Practices for Computer Security?

Computer and network security is a topic that grows in importance every single day

We recommend as many as possible of the following be employed:

Lastly, you’ve got to “rinse and repeat”. These are processes that are never “done”, it’s a continuous process. Training of new employees, patching of servers, updating of firmware – it truly never ends.

Have a question? Get in contact with us now

The Human Element – the Ultimate Weak Link?

Malware on a phone
The last item in the list is certainly not the least important. In fact, training your employees to be security aware and conscious is the most important item in the list. A person can easily circumvent many of the protections inadvertently, if they don’t know better. Another reason is that “Social Engineering” is still a big success for attackers. Make sure your employees are up to date on the latest scams, and that they are suspicious of any unexpected emails, phone calls, etc. There is a particular scam that involves the web browser displaying a message, and an audible alarm, and even a toll-free number. The message is that your machine has a virus (it doesn’t) and when you call the number, you will get a real, live person. They will promptly take your credit card information, and do nothing, other than take your money. You might be thinking, well that sounds very obviously like a scam, yet people fall for it every day.

We also see other advanced scams, such as “counterfeit” web sites meant to look like cloud services you use regularly. They’ve taken the login page for a popular app and “cloned” it. If your users enter their credentials, the attacker can then do several things – send email on their behalf, access private information, etc. Note that 2FA will stop this sort of attack, but not every service provides a 2FA capability.

In summary, the human element is the most important. Make sure your employees are trained and knowledgeable.

How to Implement

What if you are missing some, or all, of the above? Create a prioritized roadmap, and implement as budget becomes available. There are training, hardware, and software options that can meet any level of budget.

Get Help from the Security Experts

If you’re missing any of the above, let us know, we’d love to help. The business should focus on business, and let IT security be handled by the experts. Give us a call at (407) 268-6626.

Have a question? Get in contact with us now

IT Support by Virtual Operations

Virtual Operations provides IT support for small businesses in the Orlando and Central Florida area. Our managed IT services offering provides the expertise and quality care your small business needs. Please contact us today to find out how we can help with your computer support and network support needs.


Like To Learn More? Send Us A Message or call direct 407.268.6626

Back to Blog

Sign up for free and be the first to know about updates

Subscribe to Email Updates

It appears you are viewing this site through an obsolete web browser.

This site was built to comply with modern web standards and relies on features unavailable in browsers that are out of date.

You can learn more about your browser here. And you can learn more about modern web browsers here.

To hide this notice, click here.