Methods of Protecting Networks
Goal of Network Protection
Allow authorised users in. Keep unauthorised users out.
Three main methods are required for the exam: authentication, physical security and firewalls. Finding vulnerabilities before attackers do requires penetration testing.
1. Authentication
Authentication is the process of verifying a user’s identity before granting access to a network or system.
- Users provide a username + password to log in
- Network managers can enforce password policies: minimum length, complexity requirements, expiry periods
- Different users are granted different levels of access (permissions) , Example: Teachers can access pupil records; students cannot
- Also used for: online accounts, VPN access, remote login
Limitations: Passwords can be stolen, guessed or shared. Multi-factor authentication (MFA) adds an additional layer beyond passwords.
2. Physical Security
Physical security protects the hardware and infrastructure itself from unauthorised physical access.
| Measure | Purpose |
|---|---|
| CCTV cameras | Surveillance and deterrent |
| Security guards | Physical access control |
| Door locks / electronic key cards | Restrict access to server rooms and computer labs |
| Fences and perimeters | Prevent unauthorised site access |
Where used: Banks, medical research centres, government buildings, military facilities, data centres.
Trade-off: Physical security, especially staffing, is expensive.
Limitation: Protects hardware but not data sent across networks.
3. Firewalls
A firewall is hardware, software, or both, that controls what network traffic is allowed in and out.
| Function | Detail |
|---|---|
| Filters incoming traffic | Blocks connections from suspicious sources |
| Filters outgoing traffic | Prevents unauthorised data from leaving the network |
| Blocks specific ports | Stops access to particular services |
| Inspects packet contents | Deep packet inspection to detect malicious content |
| Enforces content rules | Schools block inappropriate websites |
- Come pre-installed on most operating systems and home routers
- Larger organisations use dedicated hardware firewall systems
- Works in both directions: blocks external threats AND restricts internal access
Limitation: Cannot detect threats it has not been configured to recognise; cannot stop a user who authenticates legitimately and then misuses access.
Penetration Testing
Penetration testing (pen testing) proactively identifies vulnerabilities by simulating a hacker attempting to access the system, before real attackers can exploit those weaknesses.
Types of Hacker (Context)
| Type | Description |
|---|---|
| Black-hat | Malicious; steals data or causes damage for personal gain |
| White-hat | Ethical security experts hired to find and fix flaws |
| Grey-hat | Find flaws without permission but notify the company; technically illegal |
Two Types of Penetration Testing
| Type | Simulates | Tester’s knowledge |
|---|---|---|
| White-box testing | A malicious insider (someone within the company) | Has some prior knowledge: login credentials, system architecture |
| Black-box testing | An external attacker | No prior knowledge of the system |
White-box tests what damage an informed insider could cause. Black-box tests exposure to outside threats.
Summary
| Method | Protects Against | Limitation |
|---|---|---|
| Authentication | Unauthorised user login | Passwords can be stolen or shared |
| Physical security | Physical hardware theft/access | Expensive; doesn’t protect network traffic |
| Firewall | Malicious network traffic | Cannot stop authorised users from misusing access |
| Penetration testing | Unknown vulnerabilities | Only finds flaws testers think to look for |
Exam Questions
Q: State three methods of protecting a network and give one example of each.
- Authentication, using a username and password to verify identity before granting network access. 2. Physical security, using CCTV cameras or locked doors to prevent unauthorised physical access to hardware. 3. Firewall, using software or hardware to filter incoming and outgoing network traffic, blocking suspicious connections.
Q: Describe the difference between white-box and black-box penetration testing.
White-box testing simulates a malicious insider, the tester has prior knowledge such as login credentials and tests what damage someone inside the company could do. Black-box testing simulates an external attacker with no prior knowledge, testing how vulnerable the system is from outside.
Exam Tip
When asked to “evaluate” a protection method, give both its benefit and its limitation. No single method is a complete solution, networks need layered security.