No single countermeasure prevents every network attack. Multi-factor authentication (MFA), intrusion detection systems (IDS), intrusion prevention systems (IPS), and TLS provide different protections and should be combined as defence in depth.
How Each Countermeasure Works
| Countermeasure | Protection provided | Limitation |
|---|---|---|
| MFA | Requires authentication factors from at least two categories, such as knowledge (password), possession (security token), or inherence (fingerprint). A stolen password alone is therefore insufficient. | Does not encrypt network traffic or prevent malware and denial-of-service attacks. Users may still approve fraudulent login requests. |
| IDS | Monitors network traffic or host activity and generates an alert when it identifies suspicious patterns or rule violations. Detection may be signature-based or anomaly-based. | Normally detects and reports an attack rather than blocking it. Unknown attacks may evade signatures, while anomaly detection may produce false positives. |
| IPS | Monitors traffic inline and automatically responds, for example by dropping malicious packets, blocking an IP address, or terminating a connection. | Incorrect rules can block legitimate traffic. Because it operates inline, failure or processing delays may affect network availability. |
| SSL/TLS | Transport Layer Security (TLS) encrypts data in transit, checks data integrity, and uses digital certificates to authenticate servers. It reduces eavesdropping and man-in-the-middle attacks. | It does not protect data before encryption or after decryption, and it cannot make a malicious website trustworthy. Certificate validation remains essential. |
SSL is an older, insecure predecessor of TLS. Although “SSL” is often used informally, modern secure connections should use TLS.
A common misconception is that an IDS blocks attacks. An IDS primarily detects and alerts, whereas an IPS is positioned to detect and prevent automatically.
Exam Technique
For an IB Computer Science HL response, do not merely list these controls. Explain the mechanism, connect each countermeasure to a specific threat, and identify one limitation. If asked to evaluate security, conclude that layered controls are stronger because they protect authentication, monitoring, active prevention, and data transmission at different points.
