+PL-08(01) Defense in Depth

PL-08(01) Defense in Depth

Control

Design the security and privacy architectures for the system using a defense-in-depth approach that:
  1. Allocates [Assignement: controls] to [Assignement: locations and architectural layers] ; and
  2. Ensures that the allocated controls operate in a coordinated and mutually reinforcing manner.

Discussion

Organizations strategically allocate security and privacy controls in the security and privacy architectures so that adversaries must overcome multiple controls to achieve their objective. Requiring adversaries to defeat multiple controls makes it more difficult to attack information resources by increasing the work factor of the adversary; it also increases the likelihood of detection. The coordination of allocated controls is essential to ensure that an attack that involves one control does not create adverse, unintended consequences by interfering with other controls. Unintended consequences can include system lockout and cascading alarms. The placement of controls in systems and organizations is an important activity that requires thoughtful analysis. The value of organizational assets is an important consideration in providing additional layering. Defense-in-depth architectural approaches include modularity and layering (see [SA-8(3)](#sa-8.3) ), separation of system and user functionality (see [SC-2](#sc-2) ), and security function isolation (see [SC-3](#sc-3)).

Assessment Objective

    1. the security architecture for the system is designed using a defense-in-depth approach that allocates [Assignement: controls] to [Assignement: locations and architectural layers];
    2. the privacy architecture for the system is designed using a defense-in-depth approach that allocates [Assignement: controls] to [Assignement: locations and architectural layers];
    1. the security architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner;
    2. the privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.

Assessment Method

Examine

Security and privacy planning policy procedures addressing information security and privacy architecture development enterprise architecture documentation information security and privacy architecture documentation system security plan privacy plan security and privacy CONOPS for the system other relevant documents or records

Interview

Organizational personnel with security and privacy planning and plan implementation responsibilities organizational personnel with information security and privacy architecture development responsibilities organizational personnel with information security and privacy responsibilities

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
is blocked by PL-08(01) Defense in Depth – Assessment Procedure
is blocked by Defense-In-Depth (DiD) Architecture