4.4Countermeasures and Management (Firewalls, Zero Trust, ISMS)

The threats, attack techniques, and cryptography covered so far raise a final question: how does an organization systematize and sustain these defenses? Individual technical controls (like a firewall) alone are not enough — effective information security comes from running management frameworks (ISMS, security policy) and technical controls together, as two wheels of the same cart. This section bridges technical controls and organizational management.

4.4.1Network perimeter defenses

• A firewall permits or denies traffic based on source/destination IP address and port number, judging at the network/transport layer while not inspecting the content of the communication itself. An IDS (intrusion detection system) detects malicious traffic and alerts an administrator. An IPS (intrusion prevention system) goes further, automatically blocking it as well as detecting it.
• A WAF (web application firewall) inspects the content of HTTP requests (parameters, etc.) and detects/blocks application-layer attack patterns such as SQL injection and XSS. Whereas a firewall judges by IP/port, the key difference is that a WAF looks inside the content of the traffic.
• A DMZ (demilitarized zone) places internet-facing servers such as web servers in a segment separate from the internal network. Even if a server on the DMZ is compromised via external attack, this layered defense prevents direct intrusion into the internal network. A VPN (virtual private network) builds an encrypted tunnel over a public network to securely connect remote sites or remote workers.
• Zero trust is an approach that does not assume "inside the perimeter is trustworthy," unlike traditional perimeter defense. It verifies every access attempt individually, regardless of whether it originates inside or outside the organization, and grants access to resources under the principle of least privilege. The background is that remote work and cloud adoption have blurred the traditional perimeter.