Network Security: Encryption Firewalls and Attacks

Network Security: Encryption, Firewalls, and Attacks

Network security protects data and systems from unauthorised access, modification, and disruption. At A-Level, you need to understand encryption methods, common attack vectors, and the defences used to counter them.

Encryption

Encryption converts plaintext into ciphertext using an algorithm and a key. Only someone with the correct key can decrypt it back to plaintext.

Symmetric Encryption

The same key is used for both encryption and decryption.

Aspect	Detail
Speed	Fast
Key distribution	Problem: how do both parties securely share the key?
Key count	n users need n(n−1)/2 keys (one per pair)
Examples	AES (Advanced Encryption Standard), DES, 3DES

Asymmetric Encryption (Public Key)

Uses a pair of keys: a public key (shared openly) and a private key (kept secret).

• Encrypt with public key → only the private key can decrypt (confidentiality)
• Encrypt with private key → anyone with the public key can decrypt (digital signatures/authentication)

Aspect	Detail
Speed	Slower than symmetric
Key distribution	No problem: public key is shared openly
Key count	Each user needs 1 key pair (2n keys total for n users)
Examples	RSA, Elliptic Curve Cryptography (ECC)

In practice (HTTPS/TLS): Asymmetric encryption is used to securely exchange a symmetric session key, then symmetric encryption is used for the actual data transfer (faster).

Hashing

A hash function converts input of any size into a fixed-size output (the hash/digest). It is a one-way function — you cannot reverse it to find the original input.

Properties:

• Deterministic: Same input always gives same hash
• Fixed length: Output is always the same size (e.g., SHA-256 → 256 bits)
• Collision resistant: Extremely hard to find two inputs with the same hash
• Avalanche effect: A tiny change in input completely changes the hash

Uses:

• Password storage: Store hash(password + salt), not the password itself
• Data integrity: Hash a file before and after transmission; if hashes match, data is intact
• Digital signatures: Hash the message, then encrypt the hash with the private key

Salting: Adding a random string to each password before hashing. Prevents attackers from using rainbow tables (precomputed hash lookup tables).

Digital Signatures and Certificates

Digital signature process:

1. Sender hashes the message

2. Sender encrypts the hash with their private key → this is the digital signature

3. Sender sends the message + signature

4. Receiver decrypts the signature with the sender's public key → gets the hash

5. Receiver hashes the received message independently

6. If the two hashes match → message is authentic and unmodified

Digital certificates: Issued by a Certificate Authority (CA), binding a public key to an identity. This prevents man-in-the-middle attacks where an attacker substitutes their own public key.

Firewalls

A firewall monitors and controls incoming and outgoing network traffic based on predefined security rules.

Types:

Type	How it works
Packet filtering	Inspects packet headers (source/destination IP, port, protocol); fast but basic
Stateful inspection	Tracks the state of active connections; smarter than packet filtering
Application-level gateway (proxy)	Inspects packet content at the application layer; slowest but most thorough

Firewall rules typically specify: allow/deny, protocol (TCP/UDP), source IP, destination IP, port number, direction (inbound/outbound).

Common Network Attacks

SQL Injection

Attacker inserts malicious SQL into input fields to manipulate the database.

Example: Login form with username field:

' OR '1'='1' --

This turns the query into: SELECT * FROM users WHERE username='' OR '1'='1' — which returns all users.

Prevention: Use parameterised queries (prepared statements), input validation, principle of least privilege for database accounts.

Cross-Site Scripting (XSS)

Attacker injects malicious JavaScript into a webpage viewed by other users.

Prevention: Sanitise/escape all user input before displaying it, use Content Security Policy (CSP) headers.

DDoS (Distributed Denial of Service)

Overwhelms a server with traffic from many compromised machines (botnet), making it unavailable.

Prevention: Rate limiting, traffic analysis, CDN/cloud-based DDoS protection, redundant infrastructure.

Man-in-the-Middle (MITM)

Attacker secretly intercepts and possibly modifies communication between two parties who believe they are communicating directly.

Prevention: HTTPS (TLS encryption), digital certificates, certificate pinning.

Phishing

Fake emails/websites that trick users into revealing credentials or personal information.

Prevention: User education, email filtering, multi-factor authentication, checking URLs carefully.

Brute Force

Systematically trying every possible password/key combination.

Prevention: Account lockout policies, rate limiting, strong password requirements, multi-factor authentication, salted hashing.

Defence in Depth

No single measure is sufficient. Layered security combines:

• Firewalls (network perimeter)
• Encryption (data in transit and at rest)
• Authentication (multi-factor)
• Access control (principle of least privilege)
• Intrusion detection/prevention systems (IDS/IPS)
• Regular software updates and patching
• User training and awareness
• Backup and disaster recovery

Exam Tips

• Know the difference between symmetric (one key, fast) and asymmetric (key pair, slow) encryption
• HTTPS uses both: asymmetric to exchange keys, symmetric for data — this is a common exam question
• Hashing is one-way (not encryption!) — you cannot decrypt a hash
• For SQL injection, be able to show the actual SQL that gets executed with the injected input
• Digital signatures provide authentication (who sent it) and integrity (not modified), NOT confidentiality
• When describing attacks, always pair them with specific countermeasures — generic "use a firewall" is not enough
• Defence in depth is about multiple layers — explain why no single measure is sufficient