4.3 Countermeasures

Countermeasures reduce risk

A countermeasure is any action, device, procedure, or technique that reduces a threat, vulnerability, or attack by minimizing harm or preventing it entirely. Countermeasures can be physical (locks, badges), technical (firewalls, encryption), or administrative (policies, training). Choosing the right countermeasure depends on the specific vulnerability and the acceptable level of residual risk.

Device-level protections

Common device countermeasures include strong authentication (passwords, biometrics, MFA), encryption of stored data, antivirus/anti-malware software, firewalls, and keeping software/firmware updated with patches. Physical security measures like cable locks, biometric locks, and restricting device access also protect against theft and tampering.

Layered defense (defense in depth)

No single countermeasure is foolproof, so security professionals use defense in depth — layering multiple countermeasures so if one fails, others still protect the system. For example, a laptop might use full-disk encryption, a screen lock, MFA, and automatic updates together, reducing overall risk far more than any single measure alone.

Key terms

Countermeasure

An action, device, procedure, or technique that reduces a threat, vulnerability, or attack.

Defense in depth

A strategy of layering multiple countermeasures so if one fails, others still provide protection.

Physical countermeasure

A tangible protection like a cable lock, biometric lock, or restricted access to hardware.

Technical countermeasure

Software or hardware-based protection such as firewalls, encryption, or antivirus software.

Patching/updating software

Applying updates to fix known security vulnerabilities in software or firmware.

Try an AP-style question

Full-disk encryption protects a stolen laptop's data by…

1. tracking the thief's location
2. deleting it when stolen
3. slowing down the thief
4. making it unreadable without the key