What is defense-in-depth and how is it implemented across physical, cyber, and information domains?

• A. Defense-in-depth uses multiple overlapping layers of protection so no single failure yields a breach; implemented with physical barriers, access controls, surveillance; cyber controls (segmentation, firewalls, IDS/IPS), data encryption, monitoring; information security (policy, training, incident response)
• B. Defense-in-depth is single-layer protection
• C. Defense-in-depth only concerns the cyber domain
• D. Defense-in-depth advocates removing layers to speed decisions

Answer: (A)

Defense-in-depth means building multiple, overlapping layers of protection so that no single failure leads to a breach. This holistic approach spans physical, cyber, and information domains, ensuring each domain supports the others to reduce risk.

In the physical realm, protections stack from barriers like fences and secure doors to controlled entry points, surveillance, and guards. If one barrier is compromised, others still stand to deter or detect intrusions. In the cyber domain, defenses layer through network segmentation, firewalls, intrusion detection and prevention systems, strict access controls, and continuous monitoring to catch anomalies even if a fence-line or login is bypassed. For information security, protections include clear policies, ongoing training, strong data encryption, and a solid incident response plan so that even post-breach or after misuse, actions are in place to minimize damage and recover quickly.

This is why the correct approach is to deploy multiple overlapping layers across all three domains: it reduces reliance on any single control and improves resilience. The idea isn’t a single-layer defense, nor is it limited to one domain, nor does it involve removing layers to speed decisions.