Which concept focuses on layering defenses to bolster security across systems?

Which concept focuses on layering defenses to bolster security across systems?

• A. Security Policies
• B. Defense-in-Depth
• C. EISA
• D. Information Security Policies

Answer: (B)

Layering security controls across multiple layers so that if one control fails, others still protect assets is defense-in-depth. This strategy uses overlapping protections across network, host, application, and physical domains, plus administrative measures. Think of combining firewalls and network segmentation, strong authentication and access controls, encryption for data at rest and in transit, regular patching and system hardening, continuous monitoring and incident response, backups, physical security, and ongoing security training. The aim is to reduce risk through redundancy: even if one control is bypassed or ineffective, others continue to block or mitigate an attack, increasing overall resilience. Policies describe what must be done and provide governance, but they aren’t the same as implementing layered protections. The other options refer to standards or policy categories and don’t describe the practical approach of deploying multiple, overlapping defenses across the system.

Layering security controls across multiple layers so that if one control fails, others still protect assets is defense-in-depth. This strategy uses overlapping protections across network, host, application, and physical domains, plus administrative measures. Think of combining firewalls and network segmentation, strong authentication and access controls, encryption for data at rest and in transit, regular patching and system hardening, continuous monitoring and incident response, backups, physical security, and ongoing security training. The aim is to reduce risk through redundancy: even if one control is bypassed or ineffective, others continue to block or mitigate an attack, increasing overall resilience.

Policies describe what must be done and provide governance, but they aren’t the same as implementing layered protections. The other options refer to standards or policy categories and don’t describe the practical approach of deploying multiple, overlapping defenses across the system.