Skip to main content
Information Security

Return to Answer

explain risk better
Source Link
jreisinger
jreisinger
  • 111
  • 4

This is a good question. I think that you can have both defense in depth and simplicity without contradiction.

Defense in depth is redundancy is security controls (defense mechanisms). One control can fail but it is much less probable that two or more will fail at the same time.

As for simplicity, it depends on what area you are targeting. If you're talking about applications, systems, processes you are trying to protect, there's no controversy. They should be as simple as possible and still be able to accomplish the task at hand (I know this is easy to say but difficult to do).

If you mean simplicity in security controls, I agree with AJ Henderson that they should be as simple and as independent as possible (the same principle as in the paragraph above). The only problem is related to the number of these security controls; zero is definitely more simple than three. Here you should consider the probability and impact (risk) of a failed security controlthe "problem" you're trying to protect against. The higher the risk (probability x impact) the more security controls you should deploy. But there is probably a break point in number of controls (like three) where the ratio of added value vs cost gets very low.

This is a good question. I think that you can have both defense in depth and simplicity without contradiction.

Defense in depth is redundancy is security controls (defense mechanisms). One control can fail but it is much less probable that two or more will fail at the same time.

As for simplicity, it depends on what area you are targeting. If you're talking about applications, systems, processes you are trying to protect, there's no controversy. They should be as simple as possible to accomplish the task at hand (I know this is easy to say but difficult to do).

If you mean simplicity in security controls, I agree with AJ Henderson that they should be as simple and as independent as possible (the same principle as in the paragraph above). The only problem is related to the number of these security controls; zero is definitely more simple than three. Here you should consider the probability and impact (risk) of a failed security control. The higher the risk the more security controls you should deploy. But there is probably a break point in number of controls (like three) where the ratio of added value vs cost gets very low.

This is a good question. I think that you can have both defense in depth and simplicity without contradiction.

Defense in depth is redundancy is security controls (defense mechanisms). One control can fail but it is much less probable that two or more will fail at the same time.

As for simplicity, it depends on what area you are targeting. If you're talking about applications, systems, processes you are trying to protect, there's no controversy. They should be as simple as possible and still be able to accomplish the task at hand (I know this is easy to say but difficult to do).

If you mean simplicity in security controls, I agree with AJ Henderson that they should be as simple and as independent as possible (the same principle as in the paragraph above). The only problem is related to the number of these security controls; zero is definitely more simple than three. Here you should consider the probability and impact of the "problem" you're trying to protect against. The higher the risk (probability x impact) the more security controls you should deploy. But there is probably a break point in number of controls (like three) where the ratio of added value vs cost gets very low.

Source Link
jreisinger
jreisinger
  • 111
  • 4

This is a good question. I think that you can have both defense in depth and simplicity without contradiction.

Defense in depth is redundancy is security controls (defense mechanisms). One control can fail but it is much less probable that two or more will fail at the same time.

As for simplicity, it depends on what area you are targeting. If you're talking about applications, systems, processes you are trying to protect, there's no controversy. They should be as simple as possible to accomplish the task at hand (I know this is easy to say but difficult to do).

If you mean simplicity in security controls, I agree with AJ Henderson that they should be as simple and as independent as possible (the same principle as in the paragraph above). The only problem is related to the number of these security controls; zero is definitely more simple than three. Here you should consider the probability and impact (risk) of a failed security control. The higher the risk the more security controls you should deploy. But there is probably a break point in number of controls (like three) where the ratio of added value vs cost gets very low.