Worksheet

F11.7 Defending a network

Cyber security · GCSE · OCR J277 1.4.2, AQA 8525 3.6.3, Edexcel 1CP2 4.2.1 · about 15 min

What this lesson is about

Firewalls, anti-malware, access levels, updates, backups, penetration testing and policies.

• The defences
• Penetration testing
• Network policies
• How a firewall decides

Questions 5 marks in all

1. [1 mark]What does a firewall do?

   1. ABlocks network traffic that its rules do not allow
   2. BRemoves viruses
   3. CEncrypts files
   4. DBacks up data

2. [1 mark]What is penetration testing?

   1. AAttacking your own system on purpose to find weaknesses
   2. BInstalling anti-malware
   3. CEncrypting a network
   4. DTraining staff

3. [1 mark]Why are user access levels useful?

   1. AA breached account can only reach a limited amount
   2. BThey make passwords longer
   3. CThey encrypt files
   4. DThey speed up the network

4. [1 mark]Why do automatic updates help security?

   1. AThey fix known security holes quickly
   2. BThey make the computer faster
   3. CThey add more storage
   4. DThey remove old files

5. [1 mark]What is a network policy?

   1. AThe rules an organisation sets for staying secure
   2. BA kind of firewall
   3. CA password
   4. DA backup drive

The task: a firewall

Complete the firewall. For each packet in packets (an address and a port), check the rules in order and take the action of the first rule that matches. A rule matches if its port is any or equals the packet's port, and its address is any or equals the packet's address. Print <address>:<port> -> allow or -> block, and at the end print blocked <n> of <total>.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

# each rule: (action, address, port). First match wins.
rules = [
    ("allow", "10.0.0.9", 22),
    ("block", "any", 22),
    ("allow", "any", 443),
    ("allow", "any", 80),
    ("block", "any", "any"),
]
# each packet: (address, port)
packets = [("10.0.0.9", 22), ("10.0.0.5", 22), ("10.0.0.5", 443), ("10.0.0.2", 8080), ("10.0.0.5", 80)]

Plan your program here, then type it in and press Run.

Do it on the robot
www.bugbotlab.com/learn/f11-7-defending-a-network/
The simulator checks it and tells you when it passes. Nothing to install, no account.

Challenges

1. Why does "block everything, then allow what you need" tend to be safer than "allow everything, then block what you know is bad"?
2. Add a rule of your own and see which packets it changes.
3. A company has strong technology but no network policy. Give two things that could still go wrong.