In attempting to provide a layered defense, what type of security controls should senior management be convinced to include?

The inclusion of a layered defense in security strategy is crucial because it addresses multiple potential vulnerabilities across different areas of an organization’s infrastructure. A comprehensive approach incorporates various types of security controls: administrative, physical, and technological.

Administrative controls refer to policies, procedures, and regulations intended to manage the organization's security posture. These can include training, background checks, and clear information security policies that can help mitigate human error and ensure compliance with laws and regulations.

Physical controls involve measures that protect the physical assets of the organization. This includes security cameras, access controls to facilities, and environmental controls to prevent physical threats to hardware and data.

Technological controls employ tools and software to protect the organization from cyber threats. This includes firewalls, intrusion detection systems, and encryption technologies that directly safeguard information systems and networks.

By advocating for the integration of all these types of security controls, senior management can help create a robust defense mechanism that layers protections throughout the organization, making it significantly more difficult for attackers to succeed. This holistic strategy is vital in today’s complex cybersecurity landscape, where relying on a single type of control could leave critical gaps in security. Therefore, the correct choice reflects the understanding that a multifaceted approach is essential for effective risk management and security.