How effectively firewalls protect networks

Common network vulnerabilities

Network security countermeasures

Encryption and digital certificates

A firewall can reduce unwanted network access. How well it works depends on its rules, how it is configured and where it sits in the network. To discuss its effectiveness, weigh what it can control against what it cannot detect or prevent.

### Inspecting and filtering traffic
A **firewall** inspects network traffic and permits or blocks it according to configured rules. This security system can filter incoming traffic entering a network as well as outgoing traffic leaving it.

Rules can use the source address, destination address, port number and protocol. Some firewalls inspect application traffic in greater detail too.

| Filtering approach | How it works | Main consequence |
|---|---|---|
| Whitelist | Permits explicitly approved addresses or services; denies other traffic | Restricts access tightly, but legitimate new services need approval |
| Blacklist | Blocks explicitly prohibited addresses or services | Allows flexible access, but a previously unknown unwanted source may pass |
| Rules | Set conditions for permitting or denying traffic | Protection depends on choosing suitable conditions and maintaining them |

For example, a workshop network might allow incoming connections to its public booking service but deny direct incoming access to staff computers. Its outgoing rules could allow approved services while blocking connections to prohibited destinations. In the figure, traffic is inspected in both directions before it is permitted or denied.
{{84a8d6d33f91a79f56c57f2549b8f9c88bea4e6d}}

### Strengths and limitations
| Strength | Limitation or condition |
|---|---|
| Rejects connections that do not meet the rules | A harmful request can pass if it satisfies those rules |
| Restricts which services are reachable | Services that must remain accessible still need their own protection |
| Applies consistent controls at a network boundary | Traffic that does not pass through that boundary is not controlled there |
| Can record permitted and blocked activity | Records need monitoring; they do not stop an incident themselves |
| Can restrict outgoing traffic as well as incoming traffic | Overly permissive rules weaken protection; overly restrictive rules disrupt legitimate work |

A permitted message isn't automatically safe: a firewall cannot establish that every message it allows is harmless. Encrypted content may also be unavailable for inspection unless the firewall has an appropriate inspection arrangement. Simply installing a firewall is therefore not enough. Effective protection requires maintained rules and additional safeguards.

### Network address translation
**Network address translation (NAT)** replaces address information in packets as they pass between networks. In a typical private network, it lets internal devices share a public IP address while using private addresses internally.

NAT reduces the direct exposure of internal addresses. With typical address-and-port translation, an unsolicited incoming connection has no matching translation entry. It cannot simply reach an internal device unless a mapping has been configured. NAT is not a substitute for a firewall, though. Hiding an address does not prove that allowed traffic is safe, and configured mappings can expose internal services.

**Key terms:** firewall, incoming traffic, outgoing traffic, whitelist, blacklist, rules, network address translation (NAT).

Left-to-right flow diagram titled "Firewall traffic filtering". On the left, "Incoming traffic" and "Outgoing traffic (from workshop network)" each feed into a central "Firewall inspects traffic" node with an arrow labelled "inspected". A third input, "Filtering approach: whitelist, blacklist or rules", feeds the firewall with an arrow labelled "applies". It shows the three approaches as alternatives. On the right, the firewall's outcomes are split. For incoming traffic, "permit" leads to "Public booking service (in workshop network)" and "deny" leads to "Denied: direct access to staff computers". For outgoing traffic, "permit" leads to "Approved services" and "deny" leads to "Denied: prohibited destinations". Every denied arrow ends at a "Denied" outcome, so blocked traffic never reaches staff computers or prohibited destinations.

For each vulnerability or attack, describe the weakness or method involved and the harm it can cause. The terms aren't all the same kind of thing: some describe weaknesses, others describe attack techniques. Malware is harmful software.

### Disruption, interception and deception
| Term | What happens | Possible consequence |
|---|---|---|
| **Distributed denial of service (DDoS)** | Many devices send traffic or requests towards a target at the same time, overwhelming its available resources | Legitimate users cannot access the service |
| **Insecure network protocols** | Communication rules offer inadequate protection, such as sending sensitive information without encryption | An observer may read or alter the exposed information |
| **Malware** | Malicious software runs on a device and performs unwanted actions | Data may be stolen, damaged or made inaccessible; the device may be used to attack others |
| **Man-in-the-middle (MitM) attack** | An attacker places themselves between communicating parties to intercept or potentially alter their exchange | Confidentiality and integrity may be lost; each party may believe it is communicating directly with the other |
| **Phishing attack** | A deceptive message or website poses as a trusted source to persuade someone to reveal information or take an unsafe action | Credentials may be stolen or harmful software installed |

DDoS targets availability. A MitM attack, by contrast, targets a communication exchange. The figure compares many attacking devices overwhelming one service with an attacker intercepting communication between a client and a server.
{{1c7ff9a8dcf36822033b5511764ea4fc3240e6a6}}

### Attacks through application input
**SQL injection** occurs when a system treats untrusted input as part of a database command rather than only as data. An attacker may change the intended operation to expose, modify or delete records.

With **Cross-site scripting (XSS)**, a web page includes attacker-supplied script that another user's browser then executes. This can allow actions or access to information within that user's web session.

The key difference is where the injected instructions execute. SQL injection changes database operations; XSS causes script to run in a browser. The figure shows the different destinations for malicious input.
{{e5c9e3e3d868c08e8e040eb7e24d60d69fab1281}}

### Weaknesses that leave systems exposed
| Term | Weakness or attack mechanism |
|---|---|
| **Unpatched software** | Known flaws remain because available fixes have not been installed; attackers can exploit those flaws |
| **Weak authentication** | Identity checks are easy to defeat, for example through guessable passwords or unchanged default credentials |
| **Zero-day exploit** | An attack uses a software vulnerability before a fix is available, so defenders have no applicable patch at that time |

Don't use unpatched software and zero-day exploits interchangeably. With unpatched software, an available fix has not been applied. A zero-day exploit uses a flaw for which no fix is yet available.

**Key terms:** distributed denial of service (DDoS), insecure network protocols, malware, man-in-the-middle (MitM), phishing, SQL injection, cross-site scripting (XSS), unpatched software, weak authentication, zero-day exploits.

A two-part flow diagram. On the DDoS side, one 'Many attacking devices' box sends 'many requests at once' to a 'Service (target)' box, which overwhelms it. A 'Legitimate users' box points to the same Service with the label 'cannot access', showing that availability is lost. On the MitM side, the path runs Client to 'Attacker (MitM)' to Server. The Client's exchange is intercepted by the attacker, and what reaches the Server may be altered. This shows that the attacker sits between the two communicating parties instead of the client talking to the server directly.

Two parallel input-path diagrams. SQL injection follows Malicious input to Database operations. Cross-site scripting (XSS) follows Attacker-supplied script to Web page to User's browser. Emphasize the different execution destinations without adding code.

When describing a countermeasure, explain what it does and which risk it reduces. Controls protect different points in a system. Effective security therefore combines them instead of relying on a single measure.

### Protecting applications, traffic and services
| Countermeasure | How it provides protection |
|---|---|
| **Content security policies** | Tell browsers which sources a site permits for scripts and other content, reducing opportunities for unauthorized script execution and XSS |
| **DDoS mitigation tools** | Filter detected attack traffic or distribute the load, allowing legitimate requests to keep reaching a service |
| **Email filtering solutions** | Check messages, links and attachments, then block or flag suspected phishing, malicious content and unwanted email |
| **Encrypted protocols** | Protect data in transit so intercepted traffic is not readily readable; suitable protocols also support integrity and authentication |
| **Input validation: filtering** | Rejects or removes input that contains prohibited content or patterns |
| **Input validation: whitelisting** | Accepts input only if it matches explicitly permitted types, formats, lengths or values |
| **Update software** | Install security fixes that remove known vulnerabilities from applications, operating systems and network devices |
| **Virtual private networks (VPNs)** | Protect traffic between the tunnel's endpoints by creating an encrypted tunnel across an untrusted network |

On a booking form, whitelisting could require a quantity to be a whole number within an allowed range. Filtering might instead reject prohibited characters. Validation reduces unsafe input; it doesn't guarantee that every possible attack has been excluded.

A VPN protects the tunnel, not everything its user does afterwards. DDoS protection and email filtering have limits too: they reduce risk but may miss attacks or block legitimate activity.

### Controlling access and proving server identity
| Countermeasure | How it provides protection |
|---|---|
| **Complex password policies** | Set suitable length and complexity requirements so passwords are harder to guess or crack |
| **Multifactor authentication (MFA)** | Requires evidence from different factor categories, such as something known and something possessed; a stolen password alone is therefore insufficient |
| **Secure socket layer (SSL) certificate** | The legacy term for a certificate that authenticates a server in an SSL connection; SSL itself is obsolete and should not be used |
| **Transport layer security (TLS) certificate** | Binds a server identity to a public key so a client can check that identity when establishing a TLS connection |

Two passwords still count as something known, not two different authentication factors. Pairing a password with a code from a separately held device combines different factors.

A certificate does not itself encrypt all traffic. Its role is to support authentication while the connection is established; TLS then provides protected communication. Modern certificates are often marketed as “SSL certificates” even when they are used with TLS.

### Detection versus prevention
An **intrusion detection system (IDS)** watches activity for signs of intrusion and produces alerts. An **intrusion prevention system (IPS)** can also act automatically—for example, by dropping suspicious traffic.

The figure contrasts monitoring and alerting with active blocking. Either system can misclassify traffic. A missed attack leaves a threat undetected; an incorrect block can disrupt legitimate use.
{{06ce63a736a84d8c42fcc5dd56a79b83ca682e31}}

### Wireless access controls
Wireless measures may include media access controllers (MAC), whitelists and blacklists. For device filtering, wireless access controls commonly use **MAC addresses**. A whitelist permits listed devices; a blacklist denies them. These are examples, not the only wireless security measures.

An attacker can copy an allowed device's address, which limits MAC-address filtering. The filter controls admission but does not encrypt wireless traffic.

### Regular testing and employee training
Regular security testing checks whether controls work in practice and whether changes have introduced weaknesses. Findings should lead to corrective action, followed by further testing. Passing an earlier test does not establish permanent security.

Employee training helps staff recognize phishing and handle credentials safely. It also helps them follow security procedures and report suspicious activity promptly. Threats and working practices change, so staff need refresher training.

The figure links regular security testing to corrective action and further testing, alongside employee training and prompt reporting. Technical controls and informed people support one another.
{{b183bef6c3551a72654da54a7fb6bda92f9ea5a2}}

**Key terms:** content security policies, complex password policies, DDoS mitigation tools, email filtering solutions, encrypted protocols, input validation, filtering, whitelisting, IDS, IPS, MFA, SSL certificate, TLS certificate, update software, VPNs, regular security testing, employee training, MAC, whitelists, blacklists.

Side-by-side schematics labelled IDS and IPS. IDS monitors Traffic and sends Alerts. IPS inspects Traffic and shows Blocking of suspicious traffic while allowing legitimate traffic. Use the layout to distinguish observation from intervention.

Security-maintenance relationship diagram with a cycle Regular security testing to Corrective action to Further testing. Alongside it, show Employee training leading to Prompt reporting, connected to corrective action. No additional stages or labels.

Describe how encryption uses an algorithm and a key to transform data, then distinguish how symmetric and asymmetric systems use keys. Digital certificates add identity checking. Encryption alone does not establish who is at the other end of a connection.

### From plaintext to ciphertext
**Encryption** uses an algorithm and an encryption key to turn readable data, called **plaintext**, into an unreadable form, called **ciphertext**. Decryption recovers the plaintext using the appropriate key.

In the figure, plaintext passes through encryption to become ciphertext. Decryption turns it back into plaintext. An interceptor may obtain the ciphertext, but recovering its meaning without the required key should not be practical.
{{23c7ea378733e13b8871c68c9446b6b812880661}}

### Symmetric and asymmetric cryptography
| Feature | Symmetric cryptography | Asymmetric cryptography |
|---|---|---|
| Keys | Uses the same secret key for encryption and decryption | Uses a mathematically related public-key and private-key pair |
| Sharing | Both communicating parties need the shared secret | The public key can be distributed; the private key must remain secret |
| Encrypting a confidential message | Sender encrypts with the shared key; receiver decrypts with that key | Sender encrypts with the recipient's public key; recipient decrypts with the corresponding private key |
| Practical strength | Efficient for protecting large amounts of data | Supports communication without first sharing one secret key |
| Main difficulty | Distributing and protecting the shared key | Establishing whose public key it is and protecting the private key; operations are generally more computationally demanding |

Suppose a sender encrypts a message using the recipient's public key. An observer who has that public key still cannot use it to decrypt the message. The recipient needs the corresponding private key.

Public and private keys also support digital signatures. A private key creates a signature; the public key checks it. Signing is a different operation from encrypting a confidential message to a recipient.

### Digital certificates and secure connections
A **digital certificate** is an electronic document that binds an identity to a public key and carries its issuer's digital signature. A client can use it to check whether a presented public key belongs to the intended server.

Certificates normally include the server identity and public key, along with the issuer and validity period. A certificate authority issues and signs them. The client must be able to establish trust in that issuer.

The figure shows a simplified sequence for setting up a secure connection between a client and a server:
{{8322646b646e8c4907dc86f4af539b65de4cf057}}

1. The server presents its digital certificate to the client.
2. The client checks the issuer's signature and the validity period, then checks whether the server identity matches the intended destination. It also checks that the certificate has not been revoked.
3. If the checks succeed, the connection setup uses asymmetric cryptography to authenticate the server and establish shared session keys.
4. Symmetric encryption protects the subsequent application data efficiently.

The certificate supports trust in the server's identity. It does not prove that all content supplied by that server is safe. If certificate checks fail, the connection should not be treated as authenticated.

### Encryption key management
**Encryption key management** covers how cryptographic keys are created and distributed, stored and replaced, and withdrawn throughout their use. Even strong encryption can fail if its keys are exposed or lost.

- Generate keys securely so that attackers cannot predict them.
- Use only protected methods to distribute shared secret keys; verify who owns public keys.
- Restrict access to private keys and shared secret keys, including any backups.
- Replace keys periodically and whenever compromise is suspected.
- Revoke affected certificates and withdraw compromised keys so they are no longer trusted.
- Keep authorized recovery access where necessary, then securely destroy keys that are no longer needed.

With a stolen secret key, an attacker may be able to read protected information or impersonate its owner. Losing a decryption key may leave legitimate data permanently inaccessible. Key management must protect both confidentiality and authorized access.

**Key terms:** encryption, decryption, plaintext, ciphertext, symmetric cryptography, asymmetric cryptography, public key, private key, digital certificate, certificate authority, encryption key management.

Left-to-right process diagram: Plaintext to Encryption to Ciphertext to Decryption to Plaintext. Add Encryption key entering Encryption and Appropriate key entering Decryption. Show an Interceptor accessing only Ciphertext.

Simplified client-server sequence diagram ordered as Server presents digital certificate; Client checks issuer's signature, validity period, server identity and revocation; Asymmetric cryptography authenticates server and establishes shared session keys; Symmetric encryption protects application data. Include Certificate authority as the issuer of the certificate, without suggesting it must be contacted during every connection.

Data transmissions

Explain how NAT used by the centre's router enhances the security of staff devices.

Explain two limitations of relying on the firewall as the centre's only network security control.

State one network or portal weakness (vulnerability) that an attacker could exploit.

Outline how a phishing attack could compromise a customer's portal account.

List three countermeasures that Northlight Tickets could use to protect its network or booking portal.

Explain how a distributed denial of service (DDoS) attack could disrupt the booking portal and how DDoS mitigation tools could reduce its impact.

Explain how a TLS certificate and an encrypted protocol could reduce the risk of a man-in-the-middle (MitM) attack when customers connect to the booking portal.

List three activities involved in encryption key management.

Explain the role of the digital certificate when a resident establishes a secure connection to the portal.

Explain two differences between symmetric and asymmetric cryptography when protecting the residents' documents.

Computer Science

IB Computer Science focuses on computational thinking and programming skills. Students learn about system fundamentals, network architecture, and software development, applying their knowledge to solve real-world problems through practical projects.

A2.4 Network security

Question 1

[3]

[4]

[4]

Question 2

[1]

[2]

[3]

[4]

[4]

Question 3

[3]

[4]

[4]