Security is not a switch labeled secure. It is a sliding scale from less secure to more secure, constrained by budget, time, technology, and knowledge. The practical goal is to become as secure as possible within those limits. section 6.1
Apply the continuum when making protection decisions:
- Treat security as an ongoing improvement target rather than a finished status. section 6.1
- Use layered defenses instead of relying on one control or feature; defense in depth provides backup and redundancy. section 6.1.1
- Balance stronger protection against available budget, time, technology, and knowledge. section 6.1
A castle for your data
A castle protects its king with a gatehouse, moat, drawbridge, walls, towers, and guards rather than one heroic lock. Defense in depth uses the same idea for data: multiple layers can protect it when one layer fails. section 6.1.1
Figure 6.1 The security continuum
Use the security-continuum diagram to visualize protection as a progression from less secure to more secure. section 6.1
