4.2Threats and Countermeasures (Attack Techniques, FW/IDS/IPS/WAF, Zero Trust)

Correctly matching threats to countermeasures starts with identifying which layer and mechanism an attack exploits. Malware exploits the execution environment itself, web application attacks exploit flaws in input handling, and DoS exploits the limits of processing capacity. Countermeasures also differ in what information they inspect even under the umbrella of "perimeter defense" (a firewall inspects IP/port, a WAF inspects traffic content). This section pairs attacks with countermeasures and goes on to the zero trust approach that emerged from the limits of perimeter defense.

4.2.1Malware and targeted attacks

• A virus parasitizes another program and self-replicates. A worm self-replicates as a standalone program, needing no host and spreading autonomously over a network. A Trojan horse disguises itself as harmless, gets in, and performs malicious actions such as installing a backdoor without self-replicating. Ransomware encrypts or otherwise disables files and demands payment for restoring access.
• A targeted attack aims at a specific organization or individual, using work-disguised emails to trick recipients into opening malicious files. Phishing uses fake sites or emails impersonating a real organization to steal credentials. BEC (business email compromise) impersonates a business partner or executive to trick the target into making a payment or disclosing confidential information. Unlike malware, these exploit human trust rather than a technical vulnerability.

4.2.2Web application attacks and DoS/DDoS

• SQL injection injects malicious SQL into an input field to manipulate a database improperly; the countermeasure is prepared statements (parameter binding). XSS (cross-site scripting) injects malicious script into a page so it runs in a viewer's browser; the countermeasure is sanitizing/escaping input.
• CSRF (cross-site request forgery) tricks a logged-in user's browser into sending an unintended request through another site, abusing that user's own authority. The countermeasure is a one-time token (a token that changes on each form submission, verified server-side). Distinguish XSS ("script injection") from CSRF ("request forgery abusing authority").
• A DoS attack exhausts a target's processing capacity with a flood of requests, rendering it unavailable. A DDoS attack launches a DoS attack from many distributed machines (often a botnet), defeating simple countermeasures like blocking a single source IP. The countermeasure is distributing/filtering traffic via a CDN or WAF.

4.2.3Perimeter defense, zero trust, and organizational management

• A firewall (FW) permits/denies traffic based on source/destination IP address and port number, not inspecting the content of the traffic. An IDS detects and alerts on malicious traffic. An IPS goes further, auto-blocking as well as detecting. A WAF inspects the content of HTTP requests and detects/blocks application-layer attacks like SQL injection/XSS. The key difference between an FW and a WAF is which layer of information each inspects.
• A DMZ places internet-facing servers in a segment separate from the internal network, so a breach there does not directly reach the internal network — part of layered defense. Zero trust does not assume "inside the perimeter is safe," verifying every access individually regardless of origin, driven by the blurring of the perimeter from remote work and cloud adoption. Note that zero trust adds verification rather than abolishing perimeter defense altogether.
• An ISMS is the management framework by which an organization continuously maintains and improves information security via PDCA (international standard ISO/IEC 27001). Risk management follows the process identification -> analysis -> evaluation -> response, with four response categories: mitigation, retention, avoidance, transfer. A CSIRT is a dedicated team for detecting, analyzing, and responding to incidents. Incident response order: detection/analysis -> containment -> eradication -> recovery -> post-incident activity.

Trace how an e-commerce site suffers successive attacks and strengthens defenses in stages, organizing what each countermeasure blocks. If a search-box input like ' OR '1'='1 leaks the whole catalog, the search logic embedded raw input into SQL — SQL injection, fixed by prepared statements. If a review-field script steals cookies, that is XSS (fixed by sanitizing); if a logged-in user's delivery address changes unexpectedly, that is CSRF (fixed by a one-time token). Even with an FW in place, these application-layer attacks ride over a legitimate port (443) and slip past the FW's IP/port judgment, so a WAF that inspects traffic content is separately needed. If the site then becomes unresponsive under massive simultaneous traffic from countless IPs worldwide, that is a DDoS attack (via a botnet); blocking a single IP cannot stop it, so distributing/filtering via a CDN/WAF is the realistic fix. The public web server itself is placed in a DMZ, so even if hijacked it cannot directly reach the internal customer database. As remote work expands and "internal access is safe" no longer holds, the company adopts zero trust, verifying authentication/authorization on every access regardless of origin. Alongside these technical measures, it runs risk management (identification -> analysis -> evaluation -> response) under an ISMS framework, and forms a CSIRT to handle any breach via detection/analysis -> containment -> eradication -> recovery -> post-incident activity — this combination of technical and organizational layered defense is where practice converges.

4.2.4Section summary

• Virus = parasitic; worm = self-replicating standalone; Trojan horse = no self-replication. SQL injection defended by prepared statements; XSS by sanitizing; CSRF by one-time tokens
• FW judges by IP/port; WAF inspects traffic content; IDS detects only; IPS detects and auto-blocks. DDoS = a distributed attack via a botnet
• Zero trust does not unconditionally trust even the inside of the perimeter. Four risk-response categories: mitigation, retention, avoidance, transfer. Incident response: detection/analysis -> containment -> eradication -> recovery -> post-incident activity