📡 Paper 1 · 1.2 Communication and Internet Technologies
1.2.7 Network Security (Firewalls and SSL/TLS)
Cambridge 9618 · International A Level Computer Science · ~14 min read
Notes
Video
Slides
Quiz
Worksheet
Firewalls
A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic based on predefined security rules. It creates a barrier between a trusted internal network and an untrusted external network (e.g. the internet).
How firewalls work
Firewalls inspect network traffic and either allow or block it based on rules (called an access control list or ACL). Rules are typically based on:
Source IP address
Destination IP address
Protocol (TCP, UDP, ICMP)
Port number (e.g. allow port 443/HTTPS, block port 23/Telnet)
Types of firewall
Type
Description
Notes
Packet filtering
Inspects individual packets against rules (IP, port, protocol). Does not track connection state.
Fast but less secure — cannot detect spoofed packets in an established connection
Stateful inspection
Tracks the state of network connections; only allows packets belonging to established, legitimate connections
More secure — can detect attacks that exploit connection state
Application-level (proxy)
Works at the Application layer — inspects the content of packets, not just headers
Slowest but most secure; can block specific applications or content
Limitations of firewalls
Cannot protect against threats from within the network (insider threats)
Cannot prevent users from voluntarily downloading malware
Encrypted traffic (HTTPS) is harder to inspect without additional tools
Does not protect against social engineering attacks
SSL/TLS — Secure Sockets Layer / Transport Layer Security
TLS (and its predecessor SSL) is a cryptographic protocol that provides authentication and encrypted communication over a network. It is used by HTTPS, FTPS, and email protocols.
The TLS Handshake
Before encrypted data is exchanged, TLS performs a handshake to:
Agree on which TLS version and cipher suite to use
Authenticate the server using a digital certificate (issued by a Certificate Authority)
Exchange keys to establish a shared session key for symmetric encryption
Data is then transmitted encrypted using the session key
Key concepts
Asymmetric encryption (public/private key pair) — used during handshake to securely exchange the session key
Symmetric encryption (shared session key) — used for the actual data transfer (faster than asymmetric)
Digital certificate: verifies the server's identity, signed by a trusted Certificate Authority (CA)
Certificate Authority (CA): a trusted third party (e.g. DigiCert, Let's Encrypt) that signs and vouches for digital certificates
What TLS protects against
Eavesdropping: data is encrypted — intercepted traffic cannot be read
Man-in-the-middle attacks: certificate verification confirms the server is genuine
Data tampering: integrity checks detect any modification in transit
Exam tip: Cambridge questions often ask to describe how TLS protects communication, or compare firewall types. Key points for TLS: asymmetric used in handshake, symmetric used for data; digital certificate verified by CA. For firewalls: know the 3 types and that packet filtering is fastest but least secure; stateful inspection tracks connection state.
⚠️ Common Mistakes
Saying TLS and SSL are the same — TLS is the modern successor to SSL; SSL is deprecated
Saying symmetric encryption is used in the TLS handshake — the handshake uses asymmetric to exchange the key; symmetric is used for data
Saying firewalls prevent all attacks — they cannot prevent insider threats, social engineering, or downloaded malware
8 questions · instantly marked · Cambridge 9618 standard
Q1Describe the purpose of a firewall and state two criteria typically used in firewall rules.[4]
✅ Mark scheme
Mark scheme
A firewall monitors and controls incoming and outgoing network traffic based on predefined security rules, acting as a barrier between a trusted and untrusted network [2]; any two criteria (1 each): source IP address, destination IP address, protocol (TCP/UDP), port number [2].
Q2Explain the difference between packet filtering and stateful inspection firewalls.[4]
✅ Mark scheme
Mark scheme
Packet filtering inspects each packet individually against rules (IP, port, protocol) without knowledge of connection state — fast but can be bypassed by packets that appear to belong to a legitimate connection [2]; Stateful inspection tracks the state of connections and only allows packets that are part of an established, legitimate connection — more secure as it can detect attacks using out-of-state packets [2].
Q3Describe two limitations of a firewall in protecting a network.[4]
✅ Mark scheme
Mark scheme
2 marks each for any two: Firewalls cannot protect against insider threats — malicious users within the network bypass the firewall [2]; Firewalls cannot prevent users from voluntarily downloading malware [2]; Encrypted HTTPS traffic is difficult to inspect — malicious content can be hidden inside encrypted connections [2]; Firewalls do not protect against social engineering attacks [2].
Q4Explain the role of a Certificate Authority (CA) in TLS/SSL.[3]
✅ Mark scheme
Mark scheme
A Certificate Authority is a trusted third party organisation [1]; it issues and digitally signs digital certificates that confirm a server's identity [1]; browsers trust CAs and verify a server's certificate is signed by a known CA — confirming they are communicating with the genuine server, not an impostor [1].
Q5Explain why TLS uses asymmetric encryption for the handshake but switches to symmetric encryption for data transfer.[4]
✅ Mark scheme
Mark scheme
Asymmetric encryption uses a public/private key pair — allows the client to securely exchange a session key with the server without needing to share a secret in advance [2]; however asymmetric encryption is slow — computationally expensive for large amounts of data [1]; symmetric encryption uses a single shared key and is much faster — used for encrypting the bulk of data once the session key is securely established [1].
Q6State three types of attack that TLS/SSL protects against.[3]
✅ Mark scheme
Mark scheme
1 mark each: Eavesdropping — data is encrypted so intercepted traffic cannot be read [1]; Man-in-the-middle attacks — certificate verification confirms the server's genuine identity [1]; Data tampering — integrity checks detect any modification of data in transit [1].
Q7A school's network administrator blocks all traffic on port 23 (Telnet) in the firewall. Explain why this is good security practice.[2]
✅ Mark scheme
Mark scheme
Telnet transmits data (including usernames and passwords) in plaintext — unencrypted [1]; blocking port 23 prevents attackers from using Telnet to gain unencrypted remote access to network devices — SSH (port 22) is the secure alternative [1].
Q8Describe the steps in a TLS handshake, in order.[4]
✅ Mark scheme
Mark scheme
Client and server agree on TLS version and cipher suite [1]; server sends its digital certificate (verified by browser against trusted CAs) [1]; client and server use asymmetric encryption to securely exchange/generate a shared session key [1]; data transfer begins, encrypted using the shared session key (symmetric encryption) [1].
Topic Quiz
Question 1 of 15
You scored
out of 15
Card 1 of 10
Click to reveal definition
🎉
All cards reviewed!
Term
Definition
🎯
Mini Test — 1.2.7 Network Security
10 questions · 10 marks · 10 minutes
⏱ 10:00
10 marks
Section A — Multiple Choice [5 marks]
Q1Which type of firewall tracks the state of active network connections?
Q2TLS uses asymmetric encryption during the handshake primarily to:
Q3What is the role of a Certificate Authority (CA)?
Q4Which is a limitation of a firewall?
Q5After the TLS handshake, bulk data is encrypted using:
Section B — Short Answer [5 marks]
Q6State two criteria that firewall rules can be based on.
Mark schemeAny two: source IP address; destination IP address; protocol (TCP/UDP); port number [1 mark for any two].
Q7State one attack that TLS protects against and explain how.
Mark schemeEavesdropping — data is encrypted so intercepted packets cannot be read [1]; OR Man-in-the-middle — digital certificate verification confirms server is genuine [1].
Q8Why is symmetric encryption used for data transfer in TLS rather than asymmetric?
Mark schemeSymmetric encryption is much faster than asymmetric — it uses less computational power, making it practical for encrypting large amounts of data [1 mark].
Q9State the difference between packet filtering and stateful inspection firewalls.
Mark schemePacket filtering inspects each packet individually without tracking connection state; stateful inspection tracks the state of connections and only allows packets belonging to established legitimate connections [1 mark].
Q10What is a digital certificate and what does it verify?
Mark schemeA digital certificate is a file issued and signed by a Certificate Authority [1]; it verifies the identity of a server — confirming it is who it claims to be [1]. [1 mark for either point].