{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/defence-in-depth","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/defence-in-depth/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/defence-in-depth/"},"term":{"en":"Defence in depth","da":"Lagdelt sikkerhed (defence in depth)"},"aka":{"en":["defense in depth","layered security"],"da":["defence in depth","lagdelt forsvar"]},"domain":["security"],"cluster":"fundamentals","layer":"governance","status":"current","era":2000,"summary":{"en":"Stacking several independent layers of protection so that when one fails, the next one still stops the attacker.","da":"Flere uafhængige lag af beskyttelse oven på hinanden, så det næste lag stadig stopper angriberen, når ét svigter."},"body":{"formal":{"en":"A design principle that combines several different controls - technical, organisational and physical - at different points, so that no single failure leaves an asset unprotected.","da":"Et designprincip, der kombinerer flere forskellige kontroller - tekniske, organisatoriske og fysiske - på forskellige steder, så ingen enkelt fejl efterlader et aktiv ubeskyttet."},"plain":{"en":"Like protecting a home with a locked gate, a locked door, an alarm and a safe for the valuables - a thief who gets past one still meets the next.","da":"Som at beskytte et hjem med en låst låge, en låst dør, en alarm og et pengeskab til smykkerne - en tyv, der kommer forbi det ene, møder stadig det næste."},"inPractice":{"en":"At a Danish shipping company, a phishing mail slips past the mail filter and a clerk clicks the link, but MFA stops the stolen password from being used and EDR on the laptop blocks the download.","da":"Hos et rederi slipper en phishingmail forbi mailfilteret, og en medarbejder klikker på linket - men MFA forhindrer, at den stjålne adgangskode kan bruges, og EDR på den bærbare blokerer downloaden."},"whyItMatters":{"en":"Every control fails sometimes, so relying on just one means a single mistake is enough for a breach.","da":"Enhver kontrol svigter en gang imellem, så hvis man kun har én, er en enkelt fejl nok til et brud."}},"deepDive":{"en":"The idea is borrowed from military doctrine, where a defender trades space for time instead of holding a single line. In information security it was codified around 2000 in the US NSA's Information Assurance Technical Framework, which organised it around people, technology and operations, and today NIST SP 800-53 Rev. 5 includes it as control enhancement PL-8(1) under security and privacy architectures. The logic is probabilistic: if layers fail independently, the chance that an attack passes all of them is the product of the individual miss rates, so three layers that each stop 90 % of attempts together let through about 0.1 %.\n\nIndependence is the assumption that most often breaks. James Reason's Swiss cheese model (1990), originally from accident analysis, describes each layer as a slice with holes; incidents happen when the holes line up. Common-mode failures align them systematically: the same administrator credential that controls the firewall, the EDR console and the backup server; one vendor's product at several layers sharing a vulnerability; a single identity provider behind every login; or backups reachable from the domain that ransomware has already taken over. Real depth therefore means diversity of mechanism, administration and failure mode, not just a count of products.\n\nA practical layering runs across prevention, detection and recovery as well as across location: governance and training, physical access, perimeter and email filtering, network segmentation, identity with MFA and least privilege, hardened and patched endpoints with EDR, application controls such as input validation and a WAF, data encryption and classification, logging and monitoring in a SOC, and offline or immutable backups with tested restores. The recovery layers matter because the model assumes some layer will fail; this \"assume breach\" stance also shapes the design of detection and incident response.\n\nDefence in depth contrasts with perimeter security, the \"hard shell, soft centre\" model in which a single boundary firewall protects a flat, trusted internal network, so one foothold such as a phished laptop or a compromised VPN account gives broad lateral movement. Zero Trust, as described in NIST SP 800-207 (2020), is compatible with defence in depth but shifts the emphasis from network location to per-request authentication and authorisation of every subject and resource, effectively adding layers inside the network. The principal costs are complexity, operational overhead and alert fatigue; poorly integrated layers can create gaps between them, and each added layer is also added attack surface and an added thing to patch.","da":"Idéen er lånt fra militær doktrin, hvor forsvareren bytter rum for tid i stedet for at holde en enkelt linje. Inden for informationssikkerhed blev den kodificeret omkring år 2000 i den amerikanske NSA's Information Assurance Technical Framework, som byggede den op om mennesker, teknologi og drift, og i dag indgår den i NIST SP 800-53 Rev. 5 som kontroludvidelsen PL-8(1) under sikkerheds- og privatlivsarkitektur. Logikken er sandsynlighedsbaseret: hvis lagene svigter uafhængigt af hinanden, er chancen for, at et angreb kommer igennem dem alle, produktet af de enkelte lags svigtrater, så tre lag, der hver stopper 90 % af forsøgene, tilsammen kun lukker cirka 0,1 % igennem.\n\nUafhængigheden er den antagelse, der oftest bryder sammen. James Reasons schweizerost-model (1990), oprindelig fra ulykkesanalyse, beskriver hvert lag som en osteskive med huller; hændelser sker, når hullerne flugter. Fælles fejlårsager får dem til at flugte systematisk: den samme administratorkonto styrer firewallen, EDR-konsollen og backupserveren; én leverandørs produkt i flere lag deler den samme sårbarhed; én identitetsudbyder står bag alle logins; eller backupperne kan nås fra det domæne, ransomware allerede har overtaget. Reel dybde betyder derfor forskellighed i mekanisme, administration og fejltype, ikke blot et antal produkter.\n\nEn praktisk lagdeling går på tværs af forebyggelse, opdagelse og genopretning og på tværs af placering: governance og træning, fysisk adgang, perimeter- og mailfiltrering, netværkssegmentering, identitet med MFA og mindste privilegium, hærdede og patchede endpoints med EDR, applikationskontroller som inputvalidering og en WAF, kryptering og klassifikation af data, logning og overvågning i et SOC samt offline eller immutable backup med testede gendannelser. Genopretningslagene er vigtige, fordi modellen forudsætter, at et lag vil svigte; denne \"assume breach\"-holdning præger også designet af detektion og hændelseshåndtering.\n\nLagdelt sikkerhed står i modsætning til perimetersikkerhed, \"hård skal, blød kerne\"-modellen, hvor én firewall ved grænsen beskytter et fladt, betroet internt netværk, så ét fodfæste, fx en phishet bærbar eller en kompromitteret VPN-konto, giver bred lateral bevægelse. Zero Trust, som beskrevet i NIST SP 800-207 (2020), er forenelig med lagdelt sikkerhed, men flytter vægten fra netværksplacering til autentificering og autorisation af hvert subjekt og hver ressource ved hver forespørgsel og tilføjer dermed reelt lag inde i netværket. De vigtigste omkostninger er kompleksitet, driftsbyrde og alarmtræthed; dårligt integrerede lag kan skabe huller mellem sig, og hvert nyt lag er også ny angrebsflade og en ting mere at patche."},"edges":[{"type":"requires","to":"security/control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/perimeter-security","confidence":"high","strength":"normal"},{"type":"mitigates","to":"security/threat","why":{"en":"An attacker must beat several different barriers in a row instead of just one.","da":"En angriber skal forbi flere forskellige barrierer i træk i stedet for kun én."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"security/zero-trust","why":{"en":"Zero Trust adds checks at every step, which is one more set of layers inside the network.","da":"Zero Trust tilføjer kontrol ved hvert skridt, hvilket giver endnu flere lag inde i netværket."},"confidence":"medium","strength":"normal"},{"type":"used-with","to":"cs/network-segmentation","confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"NIST Glossary - Defense-in-Depth","url":"https://csrc.nist.gov/glossary/term/defense_in_depth","tier":"standard","publisher":"NIST"},{"title":"Cyber Security Fast Track - Kursuskompendium, Modul 4","tier":"course-material"}],"draft":true}