Mitigating the risk of one security control being compromised by providing multiple layers of security controls is an example of what specific security strategy?
-
Secure-by-default
-
Secure-by-design
-
Defense-in-depth
-
Defense-by-design
To solve this question, the user needs to understand different security strategies and their definitions.
The option that describes the security strategy where multiple layers of security controls are used to mitigate the risk of one security control being compromised is:
C. Defense-in-depth
Explanation:
Defense-in-depth is a security strategy that involves layering multiple security controls to protect assets. In this strategy, if an attacker manages to breach one security control, there are other layers of security controls to prevent further access. This approach helps to mitigate the risk of any single security control being compromised. Therefore, the correct answer is option C.
Options A, B, and D are incorrect because:
A. Secure-by-default is a security strategy that involves setting secure defaults to minimize the attack surface. This strategy aims to make the system secure by default without requiring any additional configuration.
B. Secure-by-design is a security strategy that involves designing systems with security in mind from the beginning. This approach aims to make the system inherently secure through design choices such as minimizing attack surfaces and implementing secure coding practices.
D. Defense-by-design is not a recognized security strategy.
Defense-in-depth is the strategy of layering multiple, independent security controls so that if one control fails or is bypassed, others still stand in the way of a successful attack. This redundancy is exactly what's being described — mitigating the risk of any single control's compromise by not relying on it alone.