CAIE 9618 · Paper 1 · Topic 1.2.7

Network Security

Firewalls · Proxy Servers · Encryption · Digital Certificates · SSL/TLS

CSZone Cambridge International AS & A Level Computer Science 9618

Firewalls

Filtering Network Traffic

A firewall is hardware or software that monitors and controls incoming/outgoing network traffic based on predetermined security rules. It creates a barrier between a trusted internal network and untrusted external networks.

PACKET FILTERING

Inspects each packet's header (source/destination IP, port). Blocks packets not matching allow rules. Stateless — doesn't track connections.

STATEFUL INSPECTION

Tracks state of connections. Knows if a packet is part of an established connection. More secure than simple packet filtering.

Proxy Servers

Intermediary Between Client and Internet

A proxy server acts as an intermediary — clients send requests to the proxy, which forwards them on their behalf. The remote server sees only the proxy's IP address, not the client's.

Anonymity — hides the client's real IP address from external servers

Caching — stores frequently requested web pages locally, reducing bandwidth and improving speed

Content filtering — can block access to certain websites (e.g. in schools or businesses)

Logging — records all user requests for monitoring/auditing

Encryption

Symmetric vs Asymmetric

SYMMETRIC ENCRYPTION

Same key used for encryption and decryption. Fast and efficient. Problem: how to securely share the key? Examples: AES, DES.

ASYMMETRIC ENCRYPTION

Key pair: public key (encrypts) and private key (decrypts). Public key can be shared freely. Slow but solves key distribution problem. Example: RSA.

In practice: Asymmetric used to securely exchange a symmetric session key → symmetric used for actual data transfer (hybrid approach in SSL/TLS)

Digital Certificates & SSL/TLS

Trusted Identity on the Web

A digital certificate is issued by a Certificate Authority (CA) and binds a public key to the identity of a website. It proves the site is who it claims to be.

SSL/TLS — protocol that encrypts data between browser and server (HTTPS uses TLS)

Browser verifies certificate is signed by a trusted CA before establishing secure connection

Padlock icon in browser = valid TLS certificate — certificate contains: domain, public key, expiry, CA signature

If certificate expired, revoked, or unsigned by trusted CA → browser shows security warning

Exam Practice

Cambridge-style questions

Question 1

Explain the difference between symmetric and asymmetric encryption, and state one advantage of each.

4 marks

1 mark

Symmetric: same key used for encryption and decryption

1 mark

Advantage of symmetric: fast/efficient; suitable for encrypting large amounts of data

1 mark

Asymmetric: uses a key pair — public key to encrypt, private key to decrypt

1 mark

Advantage of asymmetric: solves key distribution problem — public key can be shared freely without compromising security

Exam Practice

Question 2

State two purposes of a proxy server and explain how it provides anonymity.

3 marks

1 mark

Caching — stores copies of frequently accessed web pages to reduce bandwidth and improve speed

1 mark

Content filtering — can block or restrict access to specific websites

1 mark

Anonymity: client's real IP is hidden — the proxy forwards requests on behalf of the client, so the destination server only sees the proxy's IP address

Common Mistakes

Don't lose easy marks

1

Saying a firewall prevents all attacks — firewalls filter traffic based on rules, but they don't stop threats from authorised connections (e.g. authorised user downloading malware). A firewall is one layer of defence, not a complete solution.

2

Confusing SSL and TLS — TLS is the modern, secure replacement for SSL. In exam answers, either term is usually accepted, but technically all modern HTTPS uses TLS, not SSL.

3

Saying public key decrypts the data — the public key encrypts, the private key decrypts. Get this the right way round for asymmetric encryption marks.

Topic Summary — 1.2.7

What You Need to Know

FIREWALLS

Filter packets by IP, port, protocol
Packet filtering: header only, stateless
Stateful: tracks connection state
Hardware or software based

PROXY SERVERS

Intermediary: hides client IP
Caching, filtering, logging
Client → Proxy → Server
Used in school/business networks

ENCRYPTION

Symmetric: one key, fast, key distribution problem
Asymmetric: key pair, public/private
Hybrid: asymmetric to share symmetric key
AES (symmetric), RSA (asymmetric)

CERTIFICATES & TLS

CA signs certificates binding public key to identity
TLS encrypts HTTPS connections
Padlock = valid certificate
Contains: domain, public key, CA signature

CSZone

Next Video

1.2.8

Network Hardware

Routers · Switches · WAPs · NICs · Hubs

Head to CSZone.co.uk for the complete worksheet, quiz, and interactive tools