1.3.4d Firewalls & Internet Security — OCR H446

Firewalls

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on a set of security rules. It acts as a barrier between a trusted internal network and untrusted external networks (such as the internet).

Types of Firewall

Type	How it works	Pros & Cons
Packet Filtering	Examines packet headers only (source/dest IP, port, protocol). Allows or blocks based on rules (ACLs). Stateless — each packet judged independently.	Fast, low overhead. Cannot detect sophisticated attacks that use multiple packets.
Stateful Inspection	Tracks the state of active connections. Knows whether a packet is part of an established connection or a new one. Far more context than packet filtering.	More secure than packet filtering. Higher overhead.
Application Layer (Proxy) Firewall	Inspects payload at the application layer — understands specific protocols (HTTP, FTP, DNS). Can detect malicious content within packets.	Most secure. Significant performance overhead.
Next-Generation Firewall (NGFW)	Combines stateful inspection + deep packet inspection + IDS/IPS + SSL inspection + application awareness.	Most comprehensive. Complex and expensive.

Proxy Servers

A proxy server acts as an intermediary between a client and the internet. The client sends requests to the proxy; the proxy forwards them to the web server and returns the response.

Forward Proxy

Sits between internal clients and the internet. Used by organisations to:

Cache web content — reduces bandwidth use; frequently requested pages served from cache
Content filtering — block access to certain websites (e.g. social media at work)
Anonymity — the web server sees the proxy's IP, not the client's
Logging and monitoring — records what sites users visit

Reverse Proxy

Sits between the internet and internal web servers. Used by organisations to:

Load balancing — distribute client requests across multiple servers
SSL termination — handle HTTPS encryption/decryption before forwarding to internal servers
DDoS protection — absorb attack traffic before it reaches origin servers
Hide internal server details — clients only see the proxy's IP

Encryption for Internet Security

TLS — Transport Layer Security

TLS is the protocol that provides HTTPS (secure HTTP). It provides:

Encryption — data is encrypted in transit (eavesdroppers cannot read it)
Authentication — the server's identity is verified via digital certificates
Integrity — data cannot be altered in transit without detection (via MAC — Message Authentication Code)

TLS Handshake (simplified): client sends ClientHello (supported cipher suites) → server sends Certificate + ServerHello → client verifies certificate against trusted Certificate Authorities (CAs) → session keys established using asymmetric crypto → data encrypted with symmetric session key for speed.

HTTPS vs HTTP

	HTTP	HTTPS
Port	80	443
Encryption	None — plaintext	TLS encryption
Authentication	None	Server verified via certificate
Integrity	None	MAC prevents tampering
Use	Non-sensitive pages	Login, payment, all modern sites

Symmetric and Asymmetric Encryption

	Symmetric	Asymmetric
Keys	One shared secret key for both encrypt and decrypt	Public key (encrypt) + private key (decrypt)
Speed	Fast	Slow (~1000× slower)
Problem	Key distribution — how to securely share the key?	No key distribution problem — public key can be shared openly
Example algorithms	AES, DES	RSA, ECC
Used for	Bulk data encryption (session data)	Key exchange, digital signatures, authentication

HTTPS uses a hybrid approach: asymmetric encryption is used in the TLS handshake to securely exchange a symmetric session key; that symmetric key is then used for all data in the session (faster).

Digital Certificates and Certificate Authorities (CAs)

A digital certificate is an electronic document that verifies the ownership of a public key. It contains: the public key, the domain it belongs to, the issuing CA, validity period, and a CA's digital signature.

Certificate Authorities (CAs) are trusted organisations (e.g. DigiCert, Let's Encrypt) that issue and sign certificates. Browsers have a built-in list of trusted CAs. When you visit an HTTPS site, the browser verifies the certificate was signed by a trusted CA — if so, the connection is trusted.

A self-signed certificate is not signed by a trusted CA — browsers show a "Not Secure" warning. Used only in internal/test environments.

Threat Mitigations Summary

Threat	Mitigation
Eavesdropping / MITM	HTTPS/TLS encryption; digital certificates
Unauthorised access	Firewall rules; access control lists
Content restriction	Proxy server with content filtering
DDoS attack	Reverse proxy; rate limiting; ISP-level filtering
Phishing / fake sites	Certificate validation; browser warnings for invalid certs
Port scanning / reconnaissance	Firewall — block unused ports; IDS alerts on port scans

Exam tip: Know the three types of firewall (packet filtering, stateful inspection, application layer) and compare them. Know the roles of a forward proxy (cache, filter, anonymise) vs reverse proxy (load balance, SSL termination, hide servers). Know how HTTPS uses both asymmetric and symmetric encryption (hybrid).

⚠ Common Mistakes

Saying a firewall encrypts data — firewalls FILTER traffic based on rules; encryption is handled by TLS/HTTPS.
Saying HTTPS uses only asymmetric encryption — HTTPS uses asymmetric only for the initial handshake (key exchange); all actual data uses the faster symmetric session key.
Confusing forward and reverse proxy — forward proxy sits in front of CLIENTS (used to filter/cache outgoing web traffic); reverse proxy sits in front of SERVERS (used for load balancing, DDoS protection).
Saying the proxy hides the server from the client — a forward proxy hides the CLIENT from the server. A reverse proxy hides the server from the client.

✓ Notes completed!

▶

Video coming soon

Click to advance · Arrow keys also work

Click slide or press arrow keys to navigate

✍

Worksheet — 1.3.4d Firewalls & Internet Security

8 questions · 20 marks · instantly marked

Q1Describe the difference between a packet filtering firewall and a stateful inspection firewall.[4 marks]

✓ Mark scheme

Packet filtering: examines packet headers only (source/destination IP, port number, protocol) [1]; stateless — each packet is judged independently without regard to the connection it belongs to [1]. Stateful inspection: tracks the state of active connections in a connection table [1]; can determine whether a packet is part of an established legitimate connection or an unsolicited new connection, providing far better protection against attacks that exploit the stateless nature of packet filtering [1].

Q2Explain the difference between a forward proxy and a reverse proxy, giving one use case for each.[4 marks]

✓ Mark scheme

Forward proxy: sits between internal clients and the internet; the web server sees the proxy's IP, not the client's [1]; use case: content filtering — blocking access to social media for employees; or caching — storing frequently requested pages to reduce bandwidth [1]. Reverse proxy: sits between the internet and internal servers; clients see the proxy, not the internal server [1]; use case: load balancing — distributing requests across multiple servers; or DDoS protection — absorbing attack traffic before it reaches origin servers; or SSL termination [1].

Q3Explain how TLS provides security for HTTPS connections. Include the terms "encryption", "authentication", and "integrity".[4 marks]

✓ Mark scheme

Encryption: data is encrypted in transit using TLS so that eavesdroppers cannot read the content of packets, even if they intercept them [1]. Authentication: the server's digital certificate (signed by a trusted CA) is verified, confirming the user is communicating with the genuine server and not an impersonator [1]. Integrity: TLS uses a MAC (Message Authentication Code) to detect any tampering with data in transit — if data is altered, the MAC check fails and the connection is rejected [1]. Overall: TLS uses asymmetric encryption for the handshake (to securely exchange a symmetric session key) and symmetric encryption for the actual data transfer [1].

Q4Compare symmetric and asymmetric encryption. Why does HTTPS use a hybrid of both?[4 marks]

✓ Mark scheme

Symmetric: one shared secret key for both encryption and decryption; fast; key distribution problem (how to securely share the key before the connection exists) [1]. Asymmetric: public key (freely shared, used to encrypt) + private key (kept secret, used to decrypt); no key distribution problem; ~1000× slower than symmetric [1]. HTTPS hybrid: asymmetric is used in the TLS handshake to securely exchange a symmetric session key — the client encrypts the session key with the server's public key; only the server can decrypt it with its private key [1]; once the session key is established, all actual data uses fast symmetric encryption — combining the security of asymmetric with the performance of symmetric [1].

Q5What is a digital certificate and what is the role of a Certificate Authority (CA)?[3 marks]

✓ Mark scheme

Digital certificate: an electronic document that binds a public key to a specific domain/organisation; contains the public key, domain, issuing CA, validity dates, and CA's digital signature [1]. CA (Certificate Authority): a trusted third party (e.g. DigiCert, Let's Encrypt) that verifies the identity of certificate applicants and digitally signs their certificates [1]. Browsers have a built-in list of trusted CAs; when visiting an HTTPS site, the browser verifies the certificate's CA signature — if valid and trusted, the connection proceeds; if not (e.g. self-signed or expired), a warning is shown [1].

Q6An employee at a school notices that a website they're trying to access is blocked. Explain how a proxy server could be causing this and why schools use this system.[2 marks]

✓ Mark scheme

The school uses a forward proxy server through which all student/staff internet traffic is routed; the proxy has a content filtering system (URL blacklist / category-based blocking) that prevents access to websites deemed inappropriate or distracting [1]; schools use this to protect students from harmful content, comply with safeguarding regulations, maintain network performance, and log internet usage for accountability [1].

Q7What is a self-signed certificate? When might it be used and what are its limitations?[2 marks]

✓ Mark scheme

A self-signed certificate is a digital certificate signed by the same entity that created it (not by a trusted CA) — there is no independent third-party verification of identity [1]; used in internal/test environments where the cost of a CA certificate is not justified and users can be instructed to accept it manually; limitation: browsers show a security warning because they cannot verify the certificate through a trusted CA chain — vulnerable to man-in-the-middle attacks as there is no independent verification [1].

Q8What ports are used by HTTP and HTTPS? Why does it matter that firewalls can filter by port?[2 marks]

✓ Mark scheme

HTTP uses port 80; HTTPS uses port 443 [1]. Firewalls can allow or block traffic on specific ports — for example, blocking all traffic except ports 80 and 443 prevents other protocols from being used (e.g. blocking port 21 prevents FTP); this limits the attack surface and ensures only web traffic is allowed, reducing risk from services that should not be accessible from outside [1].

Topic Quiz

1 of 15

You scored

out of 15

Card 1 of 15

Click to reveal

🎉

Complete!

Term	Definition

Firewalls

Types of Firewall

Proxy Servers

Forward Proxy

Reverse Proxy

Encryption for Internet Security

TLS — Transport Layer Security

HTTPS vs HTTP

Symmetric and Asymmetric Encryption

Digital Certificates and Certificate Authorities (CAs)

Threat Mitigations Summary

Worksheet — 1.3.4d Firewalls & Internet Security

Mini Test — 1.3.4d Firewalls & Security