A firewall monitors and controls incoming and outgoing network traffic based on a set of security rules. It acts as a barrier between a trusted internal network and untrusted external networks.
Packet filtering firewall — examines each packet's header (source/dest IP, port, protocol) and allows or blocks based on rules (ACL)
Stateful inspection firewall — tracks the state of active connections; knows if an incoming packet is part of an established connection or unsolicited
Application-layer firewall (WAF) — inspects content at application layer; can detect malicious payloads
Firewall Rules
Firewall Rules (ACL)
Firewall rules form an Access Control List (ACL) — processed top to bottom. First matching rule wins.
Rule
Src IP
Dst Port
Action
1
Any
443 (HTTPS)
ALLOW
2
Any
80 (HTTP)
ALLOW
3
Any
Any
DENY
Proxy Server
Proxy Servers
A proxy server acts as an intermediary between clients and the internet. Clients connect to the proxy; the proxy makes requests on their behalf.
Anonymity — external servers see the proxy's IP, not the client's IP
Content filtering — proxy can block access to blacklisted websites (e.g. schools blocking social media)
Caching — frequently accessed web pages cached on proxy; speeds up access and reduces bandwidth
Logging — records all web requests; useful for monitoring and auditing
IDS & IPS
Intrusion Detection & Prevention
IDS — Intrusion Detection System
Monitors network traffic for suspicious activity and sends alerts to administrators. Passive — detects but does not block. Uses signature-based or anomaly-based detection.
IPS — Intrusion Prevention System
Like IDS but actively blocks detected threats in real time. Sits inline in network traffic. Can block by IP, reset connections, or quarantine devices.
DMZ
DMZ — Demilitarised Zone
A DMZ is a network segment that sits between the public internet and a private internal network, hosting public-facing servers (web, email, DNS) while keeping the internal LAN protected.
Internet
Untrusted
→ FW →
DMZ
Web/Mail server
→ FW →
Internal LAN
Trusted
If a DMZ server is compromised, the attacker cannot directly reach the internal LAN — separated by a second firewall
Penetration Testing
Penetration Testing
Penetration testing (pen testing) is an authorised simulated cyberattack on a computer system to evaluate its security. Ethical hackers attempt to find vulnerabilities before malicious actors do.
Black box — tester has no prior knowledge of the system (simulates external attacker)
White box — tester has full knowledge of the system (simulates insider threat)
Grey box — partial knowledge (e.g. knows network architecture but not source code)
Results in a report of vulnerabilities and recommended fixes
Security Layers
Defence in Depth
Good security uses multiple layers — no single control is sufficient. An attacker who bypasses one layer faces another.
(a) Explain how a packet filtering firewall works. [3] (b) Describe TWO benefits of using a proxy server in a school network. [4] (c) What is the purpose of a DMZ in a network? [2]
[9 marks]
3 marks
(a) Examines each packet's header [1]; checks source/destination IP address and port against a set of rules (ACL) [1]; packets that match an allow rule are forwarded; those that match a deny rule are dropped/blocked [1]
4 marks
(b) Content filtering — blocks access to inappropriate/blacklisted websites [1] protecting students from harmful content [1]; Caching — stores frequently accessed pages [1] reducing bandwidth usage and speeding up access [1]
2 marks
(c) The DMZ hosts public-facing servers (web, email) [1]; it is separated from the internal network by a firewall so that if a DMZ server is compromised, the internal LAN remains protected [1]