Network Security

At A-Level you must understand the threats to networked systems and the security measures used to protect them. This lesson covers firewalls, proxy servers, intrusion detection and prevention systems (IDS/IPS), and other key network security concepts.

Common Network Threats

Threat	Description
Malware	Malicious software — viruses, worms, Trojans, ransomware, spyware
Phishing	Fraudulent emails/websites designed to trick users into revealing credentials
Man-in-the-middle (MITM)	An attacker intercepts and possibly alters communication between two parties
Denial of Service (DoS / DDoS)	Flooding a server with traffic to make it unavailable to legitimate users
SQL injection	Inserting malicious SQL into input fields to manipulate a database
Brute force	Systematically trying all possible passwords until the correct one is found
Social engineering	Manipulating people into breaking security procedures
Packet sniffing	Capturing and analysing network traffic to extract sensitive data

Firewalls

A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic based on a set of predefined rules.

Types of Firewall

Type	How It Works
Packet-filtering firewall	Inspects each packet's header (source/destination IP, port, protocol) and allows or blocks based on rules. Fast but basic — does not inspect packet contents.
Stateful inspection firewall	Tracks the state of active connections and makes decisions based on the context of the traffic (e.g. only allows responses to outgoing requests). More secure than simple packet filtering.
Application-layer firewall (proxy firewall)	Inspects the actual data payload at the application layer (e.g. HTTP content). Can detect and block malicious content inside packets. Slower but most thorough.

Firewall Rules (Simplified Example)

Rule	Source IP	Dest Port	Protocol	Action
1	Any	80	TCP	Allow (HTTP)
2	Any	443	TCP	Allow (HTTPS)
3	Any	22	TCP	Allow (SSH)
4	Any	Any	Any	Deny (default)

The firewall processes rules top to bottom and applies the first matching rule. The final rule denies everything not explicitly allowed — this is called a default deny policy.

Exam Tip: When describing a firewall, be specific about what it inspects (packet headers vs payload) and give an example rule. Avoid vague statements like "it blocks hackers" — explain the mechanism.

Proxy Servers

A proxy server acts as an intermediary between a client and a server. The client sends requests to the proxy, and the proxy forwards them to the destination server.

Network Security (firewalls, proxies, IDS/IPS)