Network security

A2.4.1 Firewalls

A firewall inspects packets and filters them using rules. Allow lists and deny lists hold IP addresses or ranges, and often port numbers. Each packet is checked against the rules until one matches.

Stateful inspection tracks active connections, so packets in an allowed connection can keep flowing until it closes. Firewalls also log traffic, which helps to detect suspicious activity.

Limits of firewalls

• They are weak against insiders, or attackers who get onto the internal Wi-Fi.
• Most do not inspect content, so harmful data can reach a legitimate destination.
• Sophisticated attacks can mimic normal traffic.
• They are only as good as their configuration and updates.

NAT and security

NAT hides internal addresses, which makes internal systems harder to reach directly. It was not designed for security, so treat it as a bonus: security by obscurity, not a defence by itself.

Next: vulnerabilities →

Next: encryption →

HL A2.4.2 Common vulnerabilities

import sqlite3

db = sqlite3.connect(":memory:")
db.execute("CREATE TABLE users (name TEXT, secret TEXT)")
db.execute("INSERT INTO users VALUES ('mali', 'blue-42')")

typed = "x' OR '1'='1"

# Unsafe: the input becomes part of the command
unsafe = "SELECT * FROM users WHERE name = '" + typed + "'"
print(db.execute(unsafe).fetchall())          # every row!

# Safe: the input is only ever data
print(db.execute("SELECT * FROM users WHERE name = ?", (typed,)).fetchall())   # []

Next: countermeasures →

HL A2.4.3 Countermeasures

Next: encryption →

A2.4.4 Encryption and digital certificates

Encryption turns data into a form that unauthorized people cannot understand. A key is the value fed into the algorithm.

Diffie-Hellman key exchange

Two people can agree a secret in public. Think of mixing paint: combining colours is easy, but unmixing them is almost impossible.

Digital signatures

The sender hashes the data, then encrypts the hash with their private key. The receiver decrypts it with the public key and compares it with their own hash. This proves who sent it and that it was not altered. The sender cannot later deny it, which is called non-repudiation.

Digital certificates

Encryption is little use if you are talking to an imposter. A certificate links a public key to an identity.

1. The bank generates a key pair and keeps the private key secret.
2. It sends the public key to a certificate authority (CA).
3. The CA checks the identity, then signs the certificate with the CA’s private key.
4. Browsers already trust the CA, so they can verify that signature with the CA’s public key.

Key pairs also allow SSH login without passwords. Your private key works like a password, so it must be stored safely.

Next: network project →

Optional project: a Raspberry Pi network

Build a small network as a class, using a separate network from the school’s. Each group runs one role on a Raspberry Pi.

Next: review →

Quick quiz

Exam-style questions

These are written for this site in the style of Paper 1. Answer on paper first, then open the mark points.

1. Discuss whether a firewall alone is enough to protect a company network. [3]

   Mark points

   • A firewall filters traffic by addresses and ports [1].
   • It may not inspect content, so malicious data to a legitimate destination can pass [1].
   • It does not stop insiders, so other measures are needed as well [1].

2. Distinguish between symmetric and asymmetric encryption. [3]

   Mark points

   • Symmetric encryption uses one shared key [1].
   • Asymmetric uses a public key to encrypt and a private key to decrypt [1].
   • Symmetric is faster, while asymmetric solves the problem of sharing a key [1].

3. Describe how NAT contributes to network security. [2]

   Mark points

   • It replaces internal addresses with a public one [1].
   • So attackers cannot see or directly reach internal devices [1].

4. Explain how a web browser can trust a bank’s website. [4]

   Mark points

   • The bank obtains a certificate from a certificate authority [1].
   • The CA verifies the bank and signs its public key with the CA’s private key [1].
   • The browser verifies that signature using the CA’s public key [1].
   • So it knows the public key belongs to the bank, not an imposter [1].

5. Explain how a digital signature proves a document has not been changed. [3]

   Mark points

   • A hash of the document is encrypted with the sender’s private key [1].
   • The receiver decrypts it with the public key and hashes the document [1].
   • If the two hashes match, it has not been altered [1].