Network Security and Threats

what is a firewall?

• A security checkpoint designed to prevent unauthorised access between two networks 

• The networks could be an internal, trusted network and an external, untrusted network like the internet 

• can be hardware or software, can also be in routers 

• Monitors incoming and outgoing network traffic 

• Usually consists of a computer containing two NICS (one for internal one for external) 

• Each data packet passing betweeen the NICS is analysed, then accepted/rejected 

what is static packet filtering?

• Controls network access according to network administrator rules and policies 

• Examines source and destination IP addresses in packet headers 

• if IP addresses are on allowed list, they are accepted 

• Packets can be blocked based on their protocols or port numbers 

• Port= when a packet reaches the network and is directed to a particular area to download its payload data to the computer 

• a dropped packet is quietly removed, whereas a rejected packet causes a rejection notice to be sent back to the sender 

what is stateful inspection (dynamic filtering)

• Checks the payload (data) of the packet instead of just the header 

• Continuously monitors incoming and outgoing traffic after a connection is established 

• Even if the data packet has a non-suspicious protocol (TCP) it could still be stealing data or installing malware 

• That sort of attack wouldn't get caught by static filtering because static filtering only checks the header and not the data 

• Maintains a connection table or state table, keeping track of all the conversations happening between trusted and untrusted networks 

• Ensures all inbound and outbound packets are expected as they all match whats in the table 

what are proxy servers?

• Intercepts all packets entering and leaving a network 

• hides true IP addresses, enabling privacy and anonymous surfing 

• Can maintain a cache of commonly used websites and return their data to user immediately without having to reconnect to internet and re-request page 

• Therefore speeds up access to webpages and reduces web traffic 

• If webpage not in cache, proxy will request it using its own IP address, return data to user, then add page to its cache for others in the same server 

• Can log all user activities for monitoring/safeguarding purposes 

• School networks use them to filter websites 

• Can serve thousands of users 

• By using proxy server based in different geographical location, users can watch videos on streaming sites that are permitted in that location but not with their home IP