CS32: Network Security
Authentication methods, encryption techniques, firewalls, MAC address filtering, and the importance of layered security.
📋 Why Network Security Matters
Key Concept: Networks are vulnerable to unauthorised access, data theft, and malicious attacks because data travels across shared infrastructure. Effective network security uses multiple methods to protect data and systems.
When computers are connected to a network, they become accessible to other devices - including potential attackers. Security measures are needed to ensure that only authorised users can access data and that data cannot be intercepted or tampered with during transmission.
- Network connections create potential entry points for attackers
- Data travelling across networks can be intercepted
- Wireless networks are especially vulnerable (signals broadcast through air)
- Multiple security methods are needed - no single method is enough
🔐 Authentication
Definition: Authentication is the process of verifying that a user is who they claim to be. It ensures that only authorised people can access a system or network.
Passwords
The most common authentication method. A user enters a username and a secret password that only they should know.
- Simple and widely used
- Can be guessed, stolen, or cracked using brute force
- Should be complex (mix of letters, numbers, symbols)
- Should be changed regularly and never shared
Biometrics
Authentication using unique biological characteristics:
- Fingerprint recognition
- Facial recognition
- Iris/retina scanning
- Voice recognition
- Very difficult to forge or steal
- Cannot be forgotten like a password
- Concerns about privacy and storage of biometric data
Two-Factor Authentication (2FA)
Definition: Two-factor authentication requires the user to provide two different types of evidence to prove their identity. This combines something you KNOW (password) with something you HAVE (phone/token) or something you ARE (biometric).
- Factor 1: Something you KNOW (password, PIN)
- Factor 2: Something you HAVE (phone, security token, smart card)
- Factor 3: Something you ARE (fingerprint, face scan)
- Even if a password is stolen, the attacker still needs the second factor
- Examples: bank card + PIN, password + SMS code, password + authenticator app
Example
When you log into Google, you enter your password (something you know). Google then sends a code to your phone (something you have) that you must also enter. Even if someone steals your password, they cannot log in without also having your phone.
| Method | How It Works | Strengths | Weaknesses |
|---|---|---|---|
| Password | Secret text known only to user | Simple, cheap, widely supported | Can be guessed, stolen, shared |
| Biometrics | Unique physical characteristic | Very hard to forge, can't forget | Expensive, privacy concerns |
| 2FA | Two different types of evidence | Much stronger than single factor | Slightly inconvenient, relies on second device |
🔒 Encryption
Definition: Encryption is the process of converting plaintext data into ciphertext (unreadable form) using an encryption algorithm and a key. Only someone with the correct decryption key can convert it back to readable plaintext.
Symmetric Encryption
Definition: Symmetric encryption uses the SAME key to encrypt and decrypt data. Both the sender and receiver must have the same secret key.
- Same key for encryption and decryption
- Fast to encrypt and decrypt
- The key must be shared securely between sender and receiver
- Problem: how do you safely share the key? If intercepted, security is compromised
- Example: AES (Advanced Encryption Standard)
Asymmetric Encryption (Public Key Encryption)
Definition: Asymmetric encryption uses a PAIR of keys: a public key (shared openly) and a private key (kept secret). Data encrypted with the public key can only be decrypted with the matching private key.
- Two keys: public key (shared with everyone) and private key (kept secret)
- Public key encrypts; private key decrypts
- No need to share a secret key - the public key can be freely distributed
- Slower than symmetric encryption
- Example: RSA encryption
How Asymmetric Encryption Works
Alice wants to send a secure message to Bob:
1. Alice obtains Bob's public key (anyone can have it)
2. Alice encrypts the message using Bob's public key
3. Alice sends the encrypted message to Bob
4. Even if the message is intercepted, only Bob's private key can decrypt it
5. Bob uses his private key to decrypt and read the message
| Property | Symmetric Encryption | Asymmetric Encryption |
|---|---|---|
| Keys used | One (same for encrypt and decrypt) | Two (public and private key pair) |
| Speed | Fast | Slower |
| Key distribution | Problem - must share secret key securely | No problem - public key can be shared openly |
| Security risk | Key can be intercepted during sharing | Private key must be kept secret |
| Use case | Bulk data encryption (fast) | Secure key exchange, digital signatures |
🛡️ Firewalls
Definition: A firewall is a network security device or software that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and an untrusted external network (like the internet).
Packet Filtering
The most common type of firewall examines each data packet and decides whether to allow or block it based on rules:
- Examines packet headers (source IP, destination IP, port numbers, protocol)
- Compares each packet against a set of rules (access control list)
- Allows packets that match permitted rules
- Blocks packets that match denied rules or don't match any rule
- Can block traffic from specific IP addresses or on specific ports
Firewall Rules Example
Rule 1: ALLOW incoming traffic on port 443 (HTTPS web traffic)
Rule 2: ALLOW outgoing traffic on port 80 (HTTP)
Rule 3: BLOCK incoming traffic on port 23 (Telnet - insecure)
Rule 4: BLOCK all traffic from IP address 192.168.45.100 (known attacker)
Rule 5: BLOCK all other incoming traffic (default deny)
- Advantages: Effective at blocking unauthorised access, can be configured to protect specific services, provides a single checkpoint for network traffic
- Limitations: Cannot prevent attacks from within the network, cannot detect all types of malicious content, cannot prevent social engineering attacks, requires expert configuration
📡 MAC Address Filtering
Definition: MAC address filtering is a security method where a network only allows devices with specific, pre-approved MAC addresses to connect. A MAC address is a unique identifier assigned to every network interface card.
- Each network device has a unique MAC address (e.g. 00:1A:2B:3C:4D:5E)
- The network maintains a whitelist of approved MAC addresses
- Only devices with approved MAC addresses can connect
- Used primarily on wireless networks (Wi-Fi routers)
Example
A company Wi-Fi network allows only these MAC addresses to connect: the CEO's laptop, the receptionist's tablet, and the meeting room computer. Any other device trying to connect is refused, even if they know the Wi-Fi password.
| Advantages | Disadvantages |
|---|---|
| Simple to set up | MAC addresses can be spoofed (faked) |
| Prevents casual unauthorised access | Difficult to manage with many devices |
| Adds an extra layer of security | Must update the list when devices change |
| No additional software needed | Not sufficient as the only security measure |
🏗️ Defence in Depth (Layered Security)
Definition: Defence in depth is a security strategy that uses multiple layers of different security measures. If one layer fails, the other layers still provide protection. No single security measure is foolproof.
The principle of defence in depth recognises that no single security method is perfect. Each method has weaknesses that can be exploited. By combining multiple methods, the overall security is much stronger.
- If a password is compromised, 2FA still protects the account
- If an attacker gets past the firewall, encryption still protects the data
- If MAC filtering is spoofed, the firewall still blocks unauthorised traffic
- Multiple layers create multiple obstacles for attackers
Defence in Depth Example
A secure company network might use ALL of these:
1. Firewall (blocks unauthorised external access)
2. Encryption (protects data even if intercepted)
3. Password + 2FA (prevents unauthorised login)
4. MAC address filtering (only approved devices can connect)
5. Anti-malware software (detects and removes malicious programs)
6. Regular security updates (patches known vulnerabilities)
Defence in Depth Principle:
Multiple layers of security > Any single security measure
If one layer fails, other layers still provide protection
Use different types of security at each layer (technical, physical, procedural)
Multiple layers of security > Any single security measure
If one layer fails, other layers still provide protection
Use different types of security at each layer (technical, physical, procedural)
⚠️ Common Mistakes to Avoid
| Mistake | Why It's Wrong | How to Fix It |
|---|---|---|
| Saying "encryption prevents hacking" | Encryption only protects data content, not access | Encryption protects data confidentiality, not system access |
| Confusing symmetric and asymmetric encryption | They use different key systems | Symmetric = same key; Asymmetric = public/private key pair |
| Saying "MAC filtering is very secure" | MAC addresses can be easily spoofed | MAC filtering is a useful extra layer but not sufficient alone |
| Saying "firewalls prevent all attacks" | Firewalls cannot prevent internal attacks or social engineering | Firewalls are one layer in defence in depth |
| Saying "2FA is just two passwords" | 2FA uses two DIFFERENT TYPES of factor | 2FA = knowledge + possession (or biometric) |
❓ Practice Questions
Q1: Explain the difference between symmetric and asymmetric encryption.
Q2: What is two-factor authentication? Give an example.
Q3: How does a firewall using packet filtering work?
Q4: What is MAC address filtering and what is its main weakness?
Q5: Explain the principle of defence in depth and why it is important.
✅ Answers
- Symmetric encryption uses the same key for both encryption and decryption. It is fast but the key must be shared securely between sender and receiver. Asymmetric encryption uses a pair of keys: a public key (shared openly) for encryption and a private key (kept secret) for decryption. It is slower but solves the key distribution problem.
- Two-factor authentication requires two different types of evidence to verify identity: something you know (password/PIN), something you have (phone/token), or something you are (biometric). Example: logging into online banking requires your password (know) and a code sent to your phone (have).
- A firewall using packet filtering examines each data packet's header information (source IP, destination IP, port numbers, protocol) and compares it against a set of predefined rules. Packets matching allowed rules are permitted through; packets matching denied rules or not matching any rule are blocked.
- MAC address filtering only allows devices with pre-approved MAC addresses to connect to a network. Its main weakness is that MAC addresses can be spoofed - an attacker can configure their device to use an approved MAC address and bypass the filter.
- Defence in depth uses multiple layers of different security measures so that if one layer fails, others still provide protection. It is important because no single security measure is foolproof - each has weaknesses. By combining methods like firewalls, encryption, authentication, and MAC filtering, the overall security is much stronger than any single method alone.
🎯 Exam Tips
- Know all authentication methods and their strengths/weaknesses
- Be clear on symmetric vs asymmetric: same key vs public/private key pair
- For firewalls, explain packet filtering with specific rule examples
- Always mention MAC spoofing as a weakness of MAC filtering
- Defence in depth: multiple layers, different types, redundancy
- When asked "how to secure a network," combine multiple methods
⚠️ Common Errors
✗ Thinking a firewall alone makes a network completely secure ✓ A firewall filters traffic based on rules but cannot prevent all threats — it doesn't protect against phishing, insider threats, or malware downloaded by users.
✗ Confusing encryption and authentication ✓ Encryption scrambles data so only authorised parties can read it. Authentication verifies the identity of a user or device. They serve different security purposes.
✗ Believing SSL/TLS makes a website completely safe ✓ SSL/TLS encrypts data in transit between browser and server. It doesn't guarantee the website itself is legitimate or that the server is secure — it only protects the connection.
✗ Not understanding the difference between a firewall and antivirus software ✓ A firewall controls network traffic in/out of a network. Antivirus scans files and programs on a device for known malware signatures. They protect against different types of threats.
✍️ Model Answer
Full-Mark Response
A company network uses a firewall and encryption. Explain two additional security measures the company should implement, justifying why each is needed despite the existing measures. [4 marks]
1. Antivirus/Anti-malware software: A firewall cannot detect malware that is already on a device or that a user downloads intentionally (e.g. from a phishing email). Antivirus software scans files and programs for known malware signatures, quarantining or removing threats that bypass the firewall. 2. User authentication (strong passwords + multi-factor authentication): Encryption protects data in transit but does not prevent unauthorised access if an attacker obtains valid credentials. Strong password policies (minimum length, complexity) and MFA (requiring a second verification step like a phone code) significantly reduce the risk of account compromise, even if passwords are leaked.
📊 AO Deep Dive
Assessment Objective Analysis
AO1 (Computational Thinking — 40%): Demonstrate knowledge and understanding of the principles and concepts of computer science, including network security: firewalls and encryption for AQA 8525, OCR J277 & Edexcel 1CP2.
AO2 (Application — 40%): Apply knowledge and understanding of computer science, including network security: firewalls and encryption to analyse problems in computational terms and to design, write and evaluate solutions.
AO3 (Evaluation — 20%): Evaluate the effectiveness, correctness and efficiency of computational solutions, including network security: firewalls and encryption, and make reasoned judgements about trade-offs.
📝 Exam Technique
GCSE Computer Science Exam Tips:
Network security measures: firewall, encryption, antivirus, authentication (passwords/MFA), user access levels, physical security. Know what each protects against and its limitations. Firewall ≠ antivirus. Encryption ≠ authentication. SSL/TLS = encrypted connection only. For security questions, always suggest multiple measures and explain WHY each is needed. No single measure provides complete protection.
Network security measures: firewall, encryption, antivirus, authentication (passwords/MFA), user access levels, physical security. Know what each protects against and its limitations. Firewall ≠ antivirus. Encryption ≠ authentication. SSL/TLS = encrypted connection only. For security questions, always suggest multiple measures and explain WHY each is needed. No single measure provides complete protection.
📝 Exam Questions by Topic
- AQA Past Papers - Topic Questions -- AQA
- Edexcel Past Papers - Topic Questions -- Edexcel
- OCR Past Papers - Topic Questions -- OCR
- Eduqas Past Papers - Topic Questions -- Eduqas
🎬 Video Resources
Ready to ace your GCSE Computer Science exams?
Get the best revision books and guides to boost your grades.