How is defense in depth strategy different from network security policy? What is the need to name it a "Defense In Depth", although you may simply name it "Network security policy"?

Secondly if DID is same as network security policy then please elaborate layered defense by example please.

  • 3
    It is not only network security. Did you check at lest wikipedia article about it? It provides even examples for you.
    – Jakuje
    Jan 24, 2016 at 13:13

2 Answers 2


The key difference is defense in depth (DiD) is a high-level concept. From the Wikipedia article:

Defense in Depth (also known as Castle Approach) is an information assurance (IA) concept

So it is much broader than a network security policy. The policy focuses on one aspect of security, the network. The policy also is a set of concrete requirements and processes. DiD is more of a general idea or mindset as to how you should think and approach security in general. So a good network security policy will implement DiD. So too will a good computer system security policy, physical access policy, etc...


Defense in Depth/Layered Security is more likely a Core Security Goal for a company, it's a concept or should I say a practice of implementing several layers of protection. You can't simply take or risk a single action by just implementing a firewall or an anti-malware software, and consider yourself protected. You must implement security at several different layers, in this way, if one layer fails, you still have several layers to protect you. It's common now a days that a company implements intrusion detection system (IDS) or intrusion prevention system (IPS), Firewalls, proxy servers for content filtering, anti-malware for every works station, HIDS/HIPS for critical servers or static environments.

Network Security Policy is more likely a generic document that states appropriate expectations regarding the use of corporate IT assets. This is closely connected to Acceptable Use Policy (AUP) but this one is focusing on workstations. In this document, organizations usually state their objective or core goals in protecting assets and the risks of not following these policies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.