Defense-in-depth revisited: qualitative risk analysis methodology for complex network-centric operations

Defense-in-depth (2000) concepts for global information operations are physical boundary-centric. However, network-centric operations are multidimensional, layered and often virtual. The interconnection of defensive operational elements, including the fixed and deployed base, runways, fighter planes, bombers, bombs, tankers, tents and individuals are logically and virtually connected. For this reason, traditional physical boundaries are minimally effective and often constraining. This paper extends the defense-in-depth boundary protection construct to a uniform qualitative risk management perspective that is tightly coupled with network implementation, resources, mission criticality, security policies and network-centric mission operations. The suggested risk management framework is applied to an operational example.