Defending a network
Firewalls, anti-malware, access levels, updates, backups, penetration testing and policies.
Do this lesson in the simulatorNo single measure keeps a network safe. Real security is layered: several defences, so that if one is bypassed, another still stands. This lesson covers the defences on the exam, from firewalls to physical locks, and builds a firewall that decides which traffic to let through.
The defences
| Defence | What it does |
|---|---|
| Firewall | checks traffic going in and out and blocks anything not allowed by its rules |
| Anti-malware | scans for and removes malware, and watches for suspicious behaviour |
| User access levels | each person can only reach what their job needs, so a breached account does limited harm |
| Strong passwords and 2FA | make accounts hard to break into (lesson F11.5) |
| Encryption | makes intercepted or stolen data unreadable (lesson F11.6) |
| Automatic updates | fix security holes as soon as they are found |
| Backups | let you recover after ransomware or loss |
| Physical security | locked doors, cable locks and cameras stop someone simply walking to the computer |
Penetration testing
Penetration testing is hiring people to attack your own system on purpose, to find the weaknesses before a real attacker does. The holes they find are fixed. It is like paying a locksmith to try to break into your house so you can improve the locks.
Network policies
A network policy is the set of rules an organisation makes for staying secure: how long passwords must be, who can install software, how often to back up, what to do if a laptop is lost. Technology cannot enforce good habits on its own, so the rules matter as much as the tools. A weak or ignored policy is itself a vulnerability.
How a firewall decides
A firewall works from a list of rules. Each packet is checked against the rules in order, and the first rule that matches decides whether it is allowed or blocked. A common design is to block everything by default and allow only what is needed.
# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()
# each rule: (allow or block, port). Checked in order; first match wins.
rules = [("allow", 443), ("allow", 80), ("block", "any")]
for port in [443, 80, 23, 8080]:
decision = "block"
for action, rule_port in rules:
if rule_port == "any" or rule_port == port:
decision = action
break
print("port", port, "->", decision)
Task: a firewall
Complete the firewall. For each packet in packets (an address and a port), check the rules in order and take the action of the first rule that matches. A rule matches if its port is any or equals the packet's port, and its address is any or equals the packet's address. Print <address>:<port> -> allow or -> block, and at the end print blocked <n> of <total>.
# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()
# each rule: (action, address, port). First match wins.
rules = [
("allow", "10.0.0.9", 22),
("block", "any", 22),
("allow", "any", 443),
("allow", "any", 80),
("block", "any", "any"),
]
# each packet: (address, port)
packets = [("10.0.0.9", 22), ("10.0.0.5", 22), ("10.0.0.5", 443), ("10.0.0.2", 8080), ("10.0.0.5", 80)]
Challenges
- Why does "block everything, then allow what you need" tend to be safer than "allow everything, then block what you know is bad"?
- Add a rule of your own and see which packets it changes.
- A company has strong technology but no network policy. Give two things that could still go wrong.