How to Build a Defense in Depth Strategy for Sensitive Data
▼ Summary
– A defense in depth strategy uses multiple security layers rather than a single control to protect sensitive data.
– Classification labels sensitive data fields like Social Security and account numbers by their sensitivity level.
– Tokenization replaces high-value data with tokens before storage, while DLP policy tuning monitors data paths such as email and file exports.
– Access controls tie identity to short-lived tokens, certificates, and MFA for secure authentication.
– A case study demonstrates each layer catching what the previous one missed, with recovery from a ransomware attack as the final defense.
In this Help Net Security interview, Venkata Pavan Kumar Gummadi, a Professional Software Engineer, outlines how to construct a defense in depth strategy for safeguarding sensitive data. He contends that a single safeguard, such as disk encryption or enabling Data Loss Prevention (DLP), creates exploitable gaps. Attackers thrive by slipping through the seams between isolated controls.
Gummadi details four interconnected layers that operate across the data life cycle. Classification tags fields like Social Security numbers and account numbers according to their sensitivity. Tokenization replaces high-value data with tokens before systems store it. DLP policy tuning monitors data movement across email, file attachments, and exports. Access controls link identity to short-lived tokens, certificates, and multi-factor authentication (MFA).
A case study demonstrates each layer catching what the previous one missed, culminating in recovery from a ransomware attack. The takeaway is straightforward. No single control wins the game. Build depth with intention, and always keep your recovery process independent.
(Source: Help Net Security)
