Say you’ve got a hundred attacks coming into your organization at a given moment. Control Number One filters out 80% of threats to give us only 20 attacks to worry about. Not bad. And then Control Number Two whacks nearly a third of those. Now the total has dropped to 13. Not a great control, but it still reduced things a bit. Finally, Control Number Three takes another 80% off that, dropping the number of attacks to just 3. By overlapping these three limited controls, you’ve created a single control that’s 97% effective.

So how does this work?

To begin at the beginning, you need to have a strong awareness of what assets need protecting and the primary threats to those assets. From here, you need to know what your highest risk items are. What threats poses the highest potential impact to the things you care about? Remember, this is a pragmatic approach—don’t waste energy defending things that don’t matter to you or against the threats that won’t do any actual harm.

Don’t get too caught up trying to demystify sophisticated attack campaigns. Instead, focus on what the potential goals of attackers could be and study their common tactics. For example, threat intelligence tells us there is a lot of business email compromise going on. A common tactic to do this is spear phishing, which is a tool of choice for both the basic scammer and sophisticated state actor. This gives us a clearly defined risk against which we can build defenses—and we know that these defenses will have a meaningful, positive impact on our security posture.

After identifying potential attack goals and tactics, you need to take stock of the controls and defenses you already have in place. Keep a careful eye on how a control works and what it specifically stops. Having three kinds of anti-virus endpoint software is different from having an anti-malware network filter, a software allowlisting solution, and an email attachment scanner. All of these are anti-malware controls, but only the latter list represents dissimilar controls that function differently. This diversity of control defense is what buys you the true defense in depth. An attacker may use a zero-day malware that no anti-virus software can detect, however an attachment blocker or allowlisting solution—which use different technologies—might find it. Or perhaps the malware will exhibit anomalous behavior that a network filter could detect. The idea is to try to solve the same problem multiple ways, hoping that at least one of the ways will trip up the attacker. It also raises the cost of attack, as the attacker will need to discover ways around three different methods, instead of just one.

It’s best to get creative when thinking about defense in depth. For spear phishing attacks, you could look at a wide range of stop-gaps such as email filters, user education, segregation of privilege, and multi-factor authentication. You may have noticed that against a spear phishing attack each of these controls has less-than-ideal stopping power by themselves, but the controls are also useful in blocking other kinds of attacks. This is where the efficiency of defense in depth really comes to bear. A good set of varied and flexible controls can curtail many different threats. When put all together, you’ve got an aggregation of smaller hurdles acting as a powerful barricade against many attacks.

Another analogy used to describe this defensive thinking is the “Swiss cheese model.”¹ Imagine placing various slices of Swiss cheese in a line to block a ray of light passing through. Each barrier has holes, like Swiss cheese, but hopefully enough of them in aggregate will stop most attacks. Like our calculation above, the Swiss cheese model also warns that sometimes the holes of the slices will align for a particular threat and thusly, a few things will slip through every barrier. As in the calculation above, 97% effective still means 3% of attacks get through. No defense is perfect. That is why you need to include some detective and restorative controls as part of defense in depth.