The big idea: No single control stops everything. Security is built in layers, so that one failing does not mean the attacker has won.
Defence in depth: This is defence in depth: assume the firewall will one day be got past, and make sure that is not the end of the story.
| Countermeasure | Stops | Does not stop |
|---|---|---|
| Firewall | Unwanted traffic at the boundary | Anything already inside, or allowed through |
| Encryption | Reading intercepted data | Someone with the password |
| Patching | Known flaws being exploited | A flaw nobody has found yet |
| Authentication | Unauthorised people | A real user who was deceived |
| Training | Deception succeeding as often | Every single person, every time |
| Backups | Loss becoming permanent | The breach happening |
Free preview
This is the free notes preview
You're reading the free notes. Aimnova Pro unlocks the full study experience — and you can try it with your first topic free to keep:
- FlashcardsLock in vocabulary and key terms with spaced repetition.
- Practice questionsAnswer exam-style questions and get instant AI marking.
- Mock exams & past-paper vaultSit full mocks and see exactly how examiners award marks.
- Personalised study planA daily plan built around your exam date and weak areas.
Start Studying Free Full access to Aimnova Pro · cancel anytime
Technical
- Firewall and network segmentation
- Encryption in transit and at rest
- Patching, and automating it
- Least privilege — the minimum access needed
Human
- Training, repeated rather than one-off
- A reporting route that is not punished
- MFA, which survives a stolen password
- Clear rules people can actually follow
Recovery
- Backups, kept offline
- Tested restores — an untested backup is a guess
- Logging, so a breach can be reconstructed
- A plan written before it is needed
The guide's countermeasures, each matched to what it stops
| Countermeasure | What it does | Answers |
|---|---|---|
| Encrypted protocols, SSL/TLS certificates | HTTPS, SSH and SFTP encrypt traffic; a TLS certificate proves the server is who it claims | Insecure protocols, sniffing, man-in-the-middle |
| VPN | An encrypted tunnel across an untrusted network | Sniffing on public Wi-Fi |
| Input validation (filtering, whitelisting) | Accept only expected input, e.g. digits in a phone field | SQL injection, XSS |
| Content security policy | Tells the browser which sources of scripts a page may run | XSS |
| Complex password policy + MFA | Long, unique passwords plus a second factor | Weak authentication, stolen passwords |
| Email filtering | Scans incoming mail and quarantines phishing and attachments with malware | Phishing, malware |
| IDS / IPS | An intrusion detection system spots suspicious traffic and alerts; a prevention system also blocks it | Attacks already under way |
| DDoS mitigation tools | Absorb and filter floods of traffic before they reach the server | DDoS |
| Updating software | Installs patches for known flaws | Unpatched software |
| Wireless MAC whitelist / blacklist | The access point lets only listed device MAC addresses join (or blocks listed ones) | Unknown devices on Wi-Fi (MAC addresses can be faked, so it is one layer only) |
| Regular security testing + employee training | Penetration tests find weaknesses before attackers do; training cuts phishing success | Unknown gaps; the human route in |
Multi-factor authentication is the highest-value single control: It turns a stolen password from a full compromise into a failed login. Since phishing and credential reuse cause most breaches, one control defeats the commonest route in.
If a question asks for the single most effective measure against phishing, this is it.
An untested backup is not a backup: Backups that have never been restored fail exactly when they are needed — wrong files, corrupted, or missing the one system that mattered.
And a backup reachable from the network can be encrypted by ransomware along with everything else, which is why an offline or immutable copy matters.
Memorize terms 3x faster
Smart flashcards show you cards right before you forget them. Perfect for definitions and key concepts.
Try Flashcards FreeYour first topic is free to keep • No credit card required
A control people cannot follow is not a control
- Force a new complex password monthly and people write them down
- Block a tool people need and they use a personal account instead
- Make reporting a mistake punishable and nobody reports, so breaches stay hidden
- The most secure system is the one people actually use as designed
- So measure a control by its effect on behaviour, not on paper
Pair every countermeasure with what it does not do: "A firewall filters traffic at the boundary — but does nothing about malware already inside, which is why segmentation and endpoint protection are also needed."
That pairing is what evaluation questions are asking for.
How this is tested — you must match a countermeasure to a specific weakness and say what it leaves uncovered. It comes up two ways:
Paper 1 Section A
- Describe common countermeasures, 3-4 marks
- State one measure against a named attack
- Explain what a firewall does
Paper 1 Section B — case study
- Recommend measures for a described organisation
- Explain why layers are needed
The classic trap: Listing controls with no weakness attached. Each must answer something specific — and a full answer says what it still leaves open.
IB-style questionSuggest[6 marks]
The small firm from the previous topic — open Wi-Fi, unpatched machines, a shared admin password, untrained staff — asks what to do. Suggest countermeasures in priority order, justifying the order.
Model answer plan
See the answer broken into clear points, with guidance on how each point earns marks.