4.2Threats and Countermeasures (Attack Techniques, FW/IDS/IPS/WAF, Zero Trust)

Correctly matching threats to countermeasures starts with identifying which layer and mechanism an attack exploits. Malware exploits the execution environment itself, web application attacks exploit flaws in input handling, and DoS exploits the limits of processing capacity. Countermeasures also differ in what information they inspect even under the umbrella of "perimeter defense" (a firewall inspects IP/port, a WAF inspects traffic content). This section pairs attacks with countermeasures and goes on to the zero trust approach that emerged from the limits of perimeter defense.

4.2.1Malware and targeted attacks

• A virus parasitizes another program and self-replicates. A worm self-replicates as a standalone program, needing no host and spreading autonomously over a network. A Trojan horse disguises itself as harmless, gets in, and performs malicious actions such as installing a backdoor without self-replicating. Ransomware encrypts or otherwise disables files and demands payment for restoring access.
• A targeted attack aims at a specific organization or individual, using work-disguised emails to trick recipients into opening malicious files. Phishing uses fake sites or emails impersonating a real organization to steal credentials. BEC (business email compromise) impersonates a business partner or executive to trick the target into making a payment or disclosing confidential information. Unlike malware, these exploit human trust rather than a technical vulnerability.