A Defensible Network Architecture is an information architecture that is monitored, controlled, minimized, and current. The idea is you transition from an “anything goes” network to one where the activity is authorized in advance, if possible. The easiest and cheapest way to begin developing DNA on an existing enterprise is to deploy Network Security Monitoring sensors capturing session data (at an absolute minimum), full content data (if you can get it), and statistical data. You should always start by monitoring first, as Bruce Schneier proclaimed so well in 2001. You can’t really implement minimization until you know who owns what.”]
Source: https://taosecurity.blogspot.com/2008/01/defensible-network-architecture-20.html