Many people I know get easily overwhelmed when they talk about IT and data security. They struggle to come up with a security strategy that covers all parts of their environment. I want to share a model called “defense in depth” that I learned from my security courses at the SANS Institute and have since used in my daily job.

The Onion Approach

In order to understand the general idea of this new concept, imagine for a moment that the data you are trying to protect is at the heart of an onion. As you know, an onion has multiple layers that completely wrap around its heart.

This same principle needs to be applied in the IT and data security space. You need to create security layers around each of the following components in your IT environment:

• Physical Access: Locked rooms and restricted areas.
• Network: Local area network switches, routers, firewalls, wireless, intrusion prevention systems, remote access servers, protocols, network operating systems (OS) and wide area networks.
• Voice: Private branch exchange phone system, voice gateways, voice mail services and instant messaging.
• Servers: OS, applications and databases.
• Endpoint Devices: Printers, scanners, desktops, laptops, tablets and smartphones.
• People: Security polices, business conduct guidelines and local regulations.

No matter how you apply security or whether you use this approach, systems can still be compromised. However, at least with the onion approach, you can make it harder for intruders by forcing them to go through multiple security controls before they finally reach their target — your data.

Security is a matter of finding the acceptable risk level for your business by measuring the effect a vulnerability in your IT environment could have, then multiplying that by the probability of an event occurring.

Data Security and Performance

Between this idea of risk management and the onion approach, you have to be careful to manage the right balance between performance and security. If your data security is too restrictive, your flexibility and ability to conduct business will be negatively affected. On the other hand, if your security is too lenient, you might be making it easier for potential intruders to find a backdoor.

If you are struggling with the complexity of securing your environment, ask yourself whether you can apply the defense in depth approach to your IT environment. The onion approach could make it easier to ensure you have covered all the bases related to your IT security.