4.4Countermeasures and Management (Firewalls, Zero Trust, ISMS)

The threats, attack techniques, and cryptography covered so far raise a final question: how does an organization systematize and sustain these defenses? Individual technical controls (like a firewall) alone are not enough — effective information security comes from running management frameworks (ISMS, security policy) and technical controls together, as two wheels of the same cart. This section bridges technical controls and organizational management.

4.4.1Network perimeter defenses

• A firewall permits or denies traffic based on source/destination IP address and port number, judging at the network/transport layer while not inspecting the content of the communication itself. An IDS (intrusion detection system) detects malicious traffic and alerts an administrator. An IPS (intrusion prevention system) goes further, automatically blocking it as well as detecting it.
• A WAF (web application firewall) inspects the content of HTTP requests (parameters, etc.) and detects/blocks application-layer attack patterns such as SQL injection and XSS. Whereas a firewall judges by IP/port, the key difference is that a WAF looks inside the content of the traffic.
• A DMZ (demilitarized zone) places internet-facing servers such as web servers in a segment separate from the internal network. Even if a server on the DMZ is compromised via external attack, this layered defense prevents direct intrusion into the internal network. A VPN (virtual private network) builds an encrypted tunnel over a public network to securely connect remote sites or remote workers.
• Zero trust is an approach that does not assume "inside the perimeter is trustworthy," unlike traditional perimeter defense. It verifies every access attempt individually, regardless of whether it originates inside or outside the organization, and grants access to resources under the principle of least privilege. The background is that remote work and cloud adoption have blurred the traditional perimeter.

4.4.2Organizational management (ISMS, access control, incident response)

• An ISMS (information security management system) is the management framework by which an organization continuously maintains and improves information security (operated as a PDCA cycle). ISO/IEC 27001 is the international standard for an ISMS; certification against it builds third-party trust. The key point is that it is an organization-wide effort covering rules, structure, and training — not just technical controls.
• A security policy systematizes an organization's information security stance, typically structured in three tiers: a basic policy (top-level, set by management) -> standards (department-level implementation rules) -> procedures (concrete operational steps). Access control rests on the principle of least privilege (granting only the minimum permissions needed for the job) and separation of duties (splitting a sequence of tasks among multiple people to prevent fraud).
• Log management collects and retains logs from servers, network devices, and applications, used for root-cause investigation and ensuring accountability when an incident occurs. Practical priorities are preventing log tampering (e.g. forwarding to write-once storage) and keeping a sufficient retention period.
• A CSIRT (computer security incident response team) is a team dedicated to detecting, analyzing, and responding to incidents within an organization. The general incident response flow is detection/analysis -> containment (stopping the damage from spreading) -> eradication (removing the cause) -> recovery -> post-incident activity (defining recurrence-prevention measures and reporting). Care must be taken to preserve logs and evidence, not destroy them in the rush to contain the incident.

Trace how a company that was attacked on its e-commerce site progressively strengthens its defenses, organizing which layer each measure protects. First, a firewall is placed at the perimeter, simply blocking traffic to ports not needed for business. But application-layer attacks (like SQL injection) slip past a firewall's IP/port criteria, so a WAF is added to inspect HTTP request contents and detect/block malicious parameters. To limit the blast radius if the public web server itself is compromised, the web server is placed in a DMZ, so that even a hijacked DMZ server cannot directly reach the internal customer database. An IDS provides continuous monitoring to catch early signs of intrusion, combined with an IPS that auto-blocks known attack patterns. All of this is still the traditional perimeter-defense mindset, but as remote work expands and employees access internal systems from various devices outside the office, the assumption "access from inside is safe" breaks down. So the company adopts zero trust, moving to a model that verifies authentication and authorization on every access, regardless of whether it originates inside or outside. In parallel, rather than relying on technical controls alone, it builds an ISMS, establishing the three-tier security policy structure of basic policy -> standards -> procedures, plus employee training and access control rules (least privilege, separation of duties). And in case a breach still occurs, it forms a CSIRT, using evidence preserved through log management to handle incidents via detection/analysis -> containment -> eradication -> recovery -> post-incident activity, this combination of technical and organizational layered defense is where practice converges.

4.4.3Section summary

• Firewall judges by IP/port; WAF inspects the content of traffic. IDS detects only; IPS detects and auto-blocks. A DMZ isolates public-facing servers
• Zero trust does not unconditionally trust even the inside of the perimeter. ISMS/ISO 27001 is an organizational management framework continuously improved via PDCA
• Security policy: basic policy -> standards -> procedures, three tiers. Incident response: detection/analysis -> containment -> eradication -> recovery -> post-incident activity