Defending a network

Firewalls, anti-malware, access levels, updates, backups, penetration testing and policies.

F11.7Cyber securityGCSE15 min

Covers OCR J277 1.4.2 Identifying and preventing vulnerabilities · AQA 8525 3.6.3 Methods to detect and prevent cyber security threats · Edexcel 1CP2 4.2.1 Network security

Do this lesson in the simulator

Print it: worksheet (PDF) · answers (PDF) · as a web page

No single measure keeps a network safe. Real security is layered: several defences, so that if one is bypassed, another still stands. This lesson covers the defences on the exam, from firewalls to physical locks, and builds a firewall that decides which traffic to let through.

The defences

Defence What it does
Firewall checks traffic going in and out and blocks anything not allowed by its rules
Anti-malware scans for and removes malware, and watches for suspicious behaviour
User access levels each person can only reach what their job needs, so a breached account does limited harm
Strong passwords and 2FA make accounts hard to break into (lesson F11.5)
Encryption makes intercepted or stolen data unreadable (lesson F11.6)
Automatic updates fix security holes as soon as they are found
Backups let you recover after ransomware or loss
Physical security locked doors, cable locks and cameras stop someone simply walking to the computer
Six layers of defence drawn as walls in front of the school's data, with six threats, each stopped by a different layerphysicalsecurityfirewallanti-malwarepasswordsand 2FAaccesslevelsencryptionschooldataa stranger walks intraffic the rules forbidmalware in an emaila guessed passworda pupil opens staff filesa laptop is stolen
Each threat, in red, gets past the layers that do not catch it and is stopped by the next one. If one layer fails, a threat still has the layers behind it to get through: that is what layered means.

Penetration testing

Penetration testing is hiring people to attack your own system on purpose, to find the weaknesses before a real attacker does. The holes they find are fixed. It is like paying a locksmith to try to break into your house so you can improve the locks.

Network policies

A network policy is the set of rules an organisation makes for staying secure: how long passwords must be, who can install software, how often to back up, what to do if a laptop is lost. Technology cannot enforce good habits on its own, so the rules matter as much as the tools. A weak or ignored policy is itself a vulnerability.

How a firewall decides

A firewall works from a list of rules. Each packet is checked against the rules in order, and the first rule that matches decides whether it is allowed or blocked. A common design is to block everything by default and allow only what is needed.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

# each rule: (allow or block, port). Checked in order; first match wins.
rules = [("allow", 443), ("allow", 80), ("block", "any")]
for port in [443, 80, 23, 8080]:
    decision = "block"
    for action, rule_port in rules:
        if rule_port == "any" or rule_port == port:
            decision = action
            break
    print("port", port, "->", decision)

Run this in the simulator

The lesson's three firewall rules as rows and its four ports as columns, each port checked down the rules until the first one that matchesrule 1allow port 443rule 2allow port 80rule 3block any portport 443not checkednot checkedallowport 80nonot checkedallowport 23nonoblockport 8080nonoblock
Each packet goes down the rules until one matches, and that rule decides; the rules below it are never looked at. Port 23 and port 8080 match no allow rule, so the last rule blocks them.

Task: a firewall

Complete the firewall. For each packet in packets (an address and a port), check the rules in order and take the action of the first rule that matches. A rule matches if its port is any or equals the packet's port, and its address is any or equals the packet's address. Print <address>:<port> -> allow or -> block, and at the end print blocked <n> of <total>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

# each rule: (action, address, port). First match wins.
rules = [
    ("allow", "10.0.0.9", 22),
    ("block", "any", 22),
    ("allow", "any", 443),
    ("allow", "any", 80),
    ("block", "any", "any"),
]
# each packet: (address, port)
packets = [("10.0.0.9", 22), ("10.0.0.5", 22), ("10.0.0.5", 443), ("10.0.0.2", 8080), ("10.0.0.5", 80)]

Challenges

  1. Why does "block everything, then allow what you need" tend to be safer than "allow everything, then block what you know is bad"?
  2. Add a rule of your own and see which packets it changes.
  3. A company has strong technology but no network policy. Give two things that could still go wrong.