Information Assurance and the Defense in Depth

This study investigates the Army's ability to provide information assurance for the NIPRNET. Information assurance includes those actions that protect and defend information and information systems by ensuring availability, integrity, authentication, confidentiality, and non-repudiation. The study examines how the military's defense in depth policy provides information assurance with a system of layered network defenses. The study also examines current practices used in the corporate world to provide information assurance. With the cooperation of the Human Firewall Council, the study compared the performance of four organizations according to standards developed for the Council's Security Management Index. The four participants in the study included: an Army Directorate of Information Management, a government agency, a university, and a web development company. The study also compared the performance of the four participants with the aggregate results obtained by the Human Firewall Council. The study concluded the defense in depth policy does grant the Army an advantage over other organizations for providing information assurance. However, the Army would benefit from incorporating some of the common practices of private corporations in their overall information assurance plans.