Global Security, Privacy, & Risk Management

Security 101; Defense in Depth August 26, 2011

This post is a complement to the post Risk101.  In reading a number of articles and positions on maritime security strategies it appears that some of the authors, while well intended, misunderstand or misstate the basics of security.   While this particular post is not a dissertation on security, it will discuss one of the more important concepts- Defense in Depth.

While defense in depth has been widely promoted as an information assurance concept developed by the NSA, it originates from military strategy. To understand how DID works, it is important to understand that security is not, and cannot be absolute.  It is not a binary concept- “secure” or “not secure”.  The appropriateness of a security strategy is relative to the identified risk.  One cannot say: “my house is secure”.  You can say: “My house has been secured in a manner that is commensurate with the identified risks”.  Security should be viewed as a function of time & effort.  Given the skills/tools, a person with sufficient time and effort can theoretically circumvent any control.  As skills/tools improve security controls must also adapt.  Safes are good examples of this concept.  The Safe Source provides US safe ratings.  Safes are rated from B1- simple theft resistant to B6 which is an underwriters certification which includes TRTL-30.  This rating means that a particular safe has been shown to 30 minutes of net working time with a torch and a range of tools including high-speed drills with carbide bits, saws and prybars.  While safe ratings are not the focus of this post, it is a good example of the security continuum.  Notice that none of the safes provide a ‘guarantee’ that it can never be breached.  With tools, and effort it is simply a matter of time.  The goal of any security strategy is to increase the risk/reward calculation to the point where the attackers give up on the effort.

The basic concept behind defense in depth is to give up space to buy time.  By implementing multiple layers of controls with each layer designed to delay the attacker it is possible to move modify the risk/reward calculation to the point where it is simply not a wise investment of time to continue the effort. Remember that security must be implemented commensurate with the identified risk.  As the risk increases the controls must increase proportionally.  Until this past year, many shipping companies were content with using less than lethal technologies to deter pirates.  As ransoms have exceeded $3million US the pirates have greater incentive to assume risk and spend the time/effort on an attack and therefore shipping companies need to increase their security controls.

Defense in Depth strategies require that companies evaluate and implement a number of controls.  In general, security controls can be categorized into detection, prevention,  and responsive controls. There is often a temptation to spend money and effort on preventive controls alone.  This is a dangerous strategy.  A complete defense in depth strategy will employ a number of overlapping controls to include best practices in ship speed, maneuvering, and routes, as well as more dynamic controls such as the use of armed guards, and citadels.  The controls should be included in a force continuum.  In short, the use of force should be the last control employed…not the first.

By ensuring that you evaluate your security needs and controls in the context of the identified risks to which your vessels are exposed you are better able to make decisions regarding the types of controls required.  By implementing the controls using a defense in depth strategy ensuring that you address detective, preventative, and responsive controls you will ensure that you have a comprehensive security strategy designed to provide the maximum defensive value at the lowest possible cost.