A firewall can reduce unwanted network access. How well it works depends on its rules, how it is configured and where it sits in the network. To discuss its effectiveness, weigh what it can control against what it cannot detect or prevent.

Inspecting and filtering traffic

A firewall inspects network traffic and permits or blocks it according to configured rules. This security system can filter incoming traffic entering a network as well as outgoing traffic leaving it.

Rules can use the source address, destination address, port number and protocol. Some firewalls inspect application traffic in greater detail too.

Strengths and limitations

A permitted message isn't automatically safe: a firewall cannot establish that every message it allows is harmless. Encrypted content may also be unavailable for inspection unless the firewall has an appropriate inspection arrangement. Simply installing a firewall is therefore not enough. Effective protection requires maintained rules and additional safeguards.

Network address translation

Network address translation (NAT) replaces address information in packets as they pass between networks. In a typical private network, it lets internal devices share a public IP address while using private addresses internally.

NAT reduces the direct exposure of internal addresses. With typical address-and-port translation, an unsolicited incoming connection has no matching translation entry. It cannot simply reach an internal device unless a mapping has been configured. NAT is not a substitute for a firewall, though. Hiding an address does not prove that allowed traffic is safe, and configured mappings can expose internal services.

Key terms: firewall, incoming traffic, outgoing traffic, whitelist, blacklist, rules, network address translation (NAT).

For each vulnerability or attack, describe the weakness or method involved and the harm it can cause. The terms aren't all the same kind of thing: some describe weaknesses, others describe attack techniques. Malware is harmful software.

Disruption, interception and deception

Attacks through application input

SQL injection occurs when a system treats untrusted input as part of a database command rather than only as data. An attacker may change the intended operation to expose, modify or delete records.

With Cross-site scripting (XSS), a web page includes attacker-supplied script that another user's browser then executes. This can allow actions or access to information within that user's web session.

Weaknesses that leave systems exposed

Don't use unpatched software and zero-day exploits interchangeably. With unpatched software, an available fix has not been applied. A zero-day exploit uses a flaw for which no fix is yet available.

Key terms: distributed denial of service (DDoS), insecure network protocols, malware, man-in-the-middle (MitM), phishing, SQL injection, cross-site scripting (XSS), unpatched software, weak authentication, zero-day exploits.

When describing a countermeasure, explain what it does and which risk it reduces. Controls protect different points in a system. Effective security therefore combines them instead of relying on a single measure.

Protecting applications, traffic and services

On a booking form, whitelisting could require a quantity to be a whole number within an allowed range. Filtering might instead reject prohibited characters. Validation reduces unsafe input; it doesn't guarantee that every possible attack has been excluded.

A VPN protects the tunnel, not everything its user does afterwards. DDoS protection and email filtering have limits too: they reduce risk but may miss attacks or block legitimate activity.

Controlling access and proving server identity

Two passwords still count as something known, not two different authentication factors. Pairing a password with a code from a separately held device combines different factors.

A certificate does not itself encrypt all traffic. Its role is to support authentication while the connection is established; TLS then provides protected communication. Modern certificates are often marketed as “SSL certificates” even when they are used with TLS.

Detection versus prevention

An intrusion detection system (IDS) watches activity for signs of intrusion and produces alerts. An intrusion prevention system (IPS) can also act automatically—for example, by dropping suspicious traffic.

Wireless access controls

Wireless measures may include media access controllers (MAC), whitelists and blacklists. For device filtering, wireless access controls commonly use MAC addresses. A whitelist permits listed devices; a blacklist denies them. These are examples, not the only wireless security measures.

An attacker can copy an allowed device's address, which limits MAC-address filtering. The filter controls admission but does not encrypt wireless traffic.

Regular testing and employee training

Regular security testing checks whether controls work in practice and whether changes have introduced weaknesses. Findings should lead to corrective action, followed by further testing. Passing an earlier test does not establish permanent security.

Employee training helps staff recognize phishing and handle credentials safely. It also helps them follow security procedures and report suspicious activity promptly. Threats and working practices change, so staff need refresher training.

Key terms: content security policies, complex password policies, DDoS mitigation tools, email filtering solutions, encrypted protocols, input validation, filtering, whitelisting, IDS, IPS, MFA, SSL certificate, TLS certificate, update software, VPNs, regular security testing, employee training, MAC, whitelists, blacklists.

Describe how encryption uses an algorithm and a key to transform data, then distinguish how symmetric and asymmetric systems use keys. Digital certificates add identity checking. Encryption alone does not establish who is at the other end of a connection.

From plaintext to ciphertext

Encryption uses an algorithm and an encryption key to turn readable data, called plaintext, into an unreadable form, called ciphertext. Decryption recovers the plaintext using the appropriate key.

Symmetric and asymmetric cryptography

Suppose a sender encrypts a message using the recipient's public key. An observer who has that public key still cannot use it to decrypt the message. The recipient needs the corresponding private key.

Public and private keys also support digital signatures. A private key creates a signature; the public key checks it. Signing is a different operation from encrypting a confidential message to a recipient.

Digital certificates and secure connections

A digital certificate is an electronic document that binds an identity to a public key and carries its issuer's digital signature. A client can use it to check whether a presented public key belongs to the intended server.

Certificates normally include the server identity and public key, along with the issuer and validity period. A certificate authority issues and signs them. The client must be able to establish trust in that issuer.

1. The server presents its digital certificate to the client.
2. The client checks the issuer's signature and the validity period, then checks whether the server identity matches the intended destination. It also checks that the certificate has not been revoked.
3. If the checks succeed, the connection setup uses asymmetric cryptography to authenticate the server and establish shared session keys.
4. Symmetric encryption protects the subsequent application data efficiently.

The certificate supports trust in the server's identity. It does not prove that all content supplied by that server is safe. If certificate checks fail, the connection should not be treated as authenticated.

Encryption key management

Encryption key management covers how cryptographic keys are created and distributed, stored and replaced, and withdrawn throughout their use. Even strong encryption can fail if its keys are exposed or lost.

• Generate keys securely so that attackers cannot predict them.
• Use only protected methods to distribute shared secret keys; verify who owns public keys.
• Restrict access to private keys and shared secret keys, including any backups.
• Replace keys periodically and whenever compromise is suspected.
• Revoke affected certificates and withdraw compromised keys so they are no longer trusted.
• Keep authorized recovery access where necessary, then securely destroy keys that are no longer needed.

With a stolen secret key, an attacker may be able to read protected information or impersonate its owner. Losing a decryption key may leave legitimate data permanently inaccessible. Key management must protect both confidentiality and authorized access.

Key terms: encryption, decryption, plaintext, ciphertext, symmetric cryptography, asymmetric cryptography, public key, private key, digital certificate, certificate authority, encryption key management.