Debate: Defence in depth is turning out to be nothing more than an expensive failure

FOR - Abe Kleinfeld, president and CEO, nCircle

Security spending is rising, but executives remain frustrated that businesses remain far from secure. Adding layers of network security simply adds to the costs and complexity, while every extra layer provides diminishing returns in effectiveness.

As well as firewalls, IDS, anti-virus and IPS at the network level, users are now creating layers at the host and application level, but where is this all heading? Businesses need to rethink their security strategies in order to improve effectiveness while containing costs.

Layers of protection are largely reactive and cannot keep pace with the alarming increase and variety of network attacks. We need a balanced approach that adds proactive security solutions to shrink the targets, solutions that are intelligence-based, continuously gathering a deep understanding of what's running on an IP network to identify risk, then prioritising the remediation of that risk.

Organisations need to balance their spending between stopping the bullets and shrinking the targets. It's time for defence-in-depth to give way to defence-in-balance.

AGAINST - Jason Holloway, UK manager, ExaProtect

Information security must address security weaknesses on many different levels, and no single, unified security product will ever address all these weaknesses properly. Defence in depth assures the security of all processes, policies and IT systems, even those not immediately thought of as security-related.

Ultimately, businesses need to protect their corporate intellectual property, wherever it is stored and however it is transmitted, accessed or modified. The challenge is managing systems, processes and policies in a coherent way.

Firewalls, IDS, AV and other systems provide a wealth of security event data that is rarely monitored properly. Even when it is, it is even more rare that it is combined with security events from non-IT security systems. It is this visibility of events in core business systems that show the real security threats to a business, using core security event management tools.

This is why groups of informed CSOs and CISOs are accelerating the move towards defence-in-depth models, because these models work and deliver value.