SECTION B

B1 explain the purpose of an Internet firewall: opening move

A firewall exists because of scale. A network with many separate connections to the Internet cannot be defended properly since an attacker only has to find the one weak connection. The firewall forces every piece of traffic in both directions through one point you can actually watch. You are not making any connection safer. You are reducing how many connections there are to defend. Do not open on what packet filtering is because that answers a different question.

B1 explain the purpose of an Internet firewall: the three purposes

First it reduces the ways in. Many doors you cannot watch become one you can and that consolidation is what makes guarding it properly affordable. Second it buys distance. An unpatched internal server is only dangerous if an attacker can reach it. Third it controls what leaves as well as what enters which is called egress filtering. That matters because malware that gets inside still has to communicate outward to receive instructions or to send stolen data back.

B1 explain the purpose of an Internet firewall: how it decides what to allow

It reads the header of each packet and nothing else. That means the source and destination IP addresses and the port numbers. Rules are written to allow the specific services the organisation actually runs and a final rule denies everything else. That final rule is called default deny. The reason for it is that you cannot write a list of every threat in the world but you can write a list of your own services.

B1 explain the purpose of an Internet firewall: boundary of responsibility

Everything behind the firewall is the organisation's network and under its control. Everything in front of it is not. It is one sentence and it is the cleanest point in part (a) because it says what a firewall is for rather than what it does.

B1 explain the purpose of an Internet firewall: closing move

Finish by placing the firewall in the whole security environment which is layered like rings. Data sits at the centre. Then technology solutions. Then organisational policies and procedures. Then laws and industry standards on the outside. The firewall belongs to the innermost and smallest ring. It is a boundary control and most incidents do not arrive through the boundary so it is necessary and nowhere near sufficient.

B1 explain the purpose of an Internet firewall: the diagram

Draw the Internet on one side and your network on the other with two or three machines inside it. Put a dashed vertical line between them and sit the firewall on that line. Add four arrows going both directions and make every one of them pass through the firewall. Label the left side not your responsibility and the right side your responsibility. The two-way arrows are the bit people leave off and they make the egress point for you.

B1 what a firewall cannot protect against: the four limits

Every limit comes from the same cause which is that it reads headers at one boundary. It cannot look inside the data part of a packet so malware arriving on a port you opened for a real service has a perfectly valid header. It cannot see traffic that goes around it such as a phone hotspot or a laptop taken home and brought back. It is a network device so it guards the network and not the individual machine. And its rules were written on a particular day so an out of date rule set is no defence against anything new.

B1 what a firewall cannot protect against: the two that matter more

A firewall cannot tell a legitimate user from a legitimate user behaving badly so it does nothing about insiders. It also does nothing about social engineering because the attacker never breaks in. Somebody is tricked into handing over their credentials and the attacker then logs in normally with valid packets and no rule broken. Phishing and scams and unauthorised access are the large majority of reported New Zealand incidents and a firewall addresses none of them.

B1 what a firewall cannot protect against: why DoS and DDoS defeat it

A denial of service attack floods a system to make it unavailable to real users and a distributed one does it from thousands of machines at once. The firewall fails because every single request looks legitimate. The harm is the volume rather than anything in one packet so there is no bad packet to drop. It cannot block thousands of addresses. Deciding to drop a packet still costs processing so it is exhausted by doing its job. And it is the bottleneck by design since everything must pass through it so it goes down along with everything behind it.

B2 what measures would you take to reduce supply chain risk after COVID-19: opening move

Start with why this is hard: you cannot see your own supply chain. Your contracts and audits and data reach tier 1 and stop. Past that is the visibility barrier. The chain can also change behind that line without telling you because a tier 1 supplier who cannot fill an order may quietly buy from someone else. Almost every serious disruption begins below tier 1 so every measure that follows is about either seeing further or surviving what you cannot see.

B2 what measures would you take to reduce supply chain risk after COVID-19: the measures

Seven of them. Dual source anything critical. Push visibility below tier 1. Hold buffer stock on critical inputs. Invest in sharing information along the chain. Build a second route to market. Avoid chokepoints and do not buy distribution on price. And plan for scenarios in advance. Write four or five rather than all seven and give each one a reason instead of just naming it.

B2 what measures would you take to reduce supply chain risk after COVID-19: dual source critical inputs

A direct material needs a second supplier because running out of it stops production entirely. A contract does not solve this. A contract gives you compensation when a supplier fails and a compensation payment does not restart a factory. Legal protection is not supply security. Optional illustration: BMW halting 3 Series production in three countries when Bosch missed steering gears.

B2 what measures would you take to reduce supply chain risk after COVID-19: push visibility below tier 1

Require tier 1 suppliers to disclose their own key suppliers. Ban undisclosed subcontracting and take the right to audit. You cannot outsource responsibility for your own chain and we did not know is an admission of a management failure rather than a defence. Be honest that the barrier moves one tier back rather than disappearing and that the visibility you gain is second hand since you are reading what tier 1 tells you. Optional illustration: an approved garment factory subcontracting to an unapproved one at Rana Plaza.

B2 what measures would you take to reduce supply chain risk after COVID-19: hold strategic buffer stock

Just in time keeps cash free and leaves no slack. Buffer stock is the opposite trade where you tie up working capital in order to buy slack. The honest point is that stock protects you when supply is cut and hurts you when demand vanishes. So the judgement is which of those two shocks is likelier for that particular input. Optional illustration: Z Energy selling fuel back onto the world market at a loss in the 2020 lockdown after committing to inputs weeks earlier.

B2 what measures would you take to reduce supply chain risk after COVID-19: invest in information flow

Share real end-customer demand along the chain so every tier can see what was actually bought instead of guessing from the orders placed below it. This is the fix for the bullwhip effect and it works because the bullwhip is an information problem rather than a logistics one. It is also the cheapest measure on the list since it buys resilience without buying inventory.

B2 what measures would you take to reduce supply chain risk after COVID-19: build a second route to market

Every other measure is about supply coming in. This one is about getting product out. The failure it prevents is not we cannot make it but we made it and cannot sell it. The second route does not have to be efficient because an awkward channel still turns a total loss into a reduced one. It does have to already exist since you cannot build a channel during the crisis. Optional illustration: New Zealand food producers who sold only to restaurants when hospitality shut.

B2 what measures would you take to reduce supply chain risk after COVID-19: avoid chokepoints

A chokepoint is any single place everything funnels through so one failure stops the whole flow. One port. One route. One plant. One component supplier. They exist because concentration is cheaper which is why removing them costs money and why nobody buys the alternative until after something breaks. Optional illustration: the Suez Canal blocked for six days.

B2 what measures would you take to reduce supply chain risk after COVID-19: do not buy distribution on price

Distribution is a capability built over years rather than a service you switch for a cheaper rate. Everything upstream can be perfectly healthy and you still cannot reach your customers. Keep this separate from chokepoints because it is a different failure: nothing was blocked and nothing ran out. Optional illustration: KFC closing most of its UK restaurants after moving to a partner that could not run a chilled daily network.

B2 what measures would you take to reduce supply chain risk after COVID-19: closing move

Finish on the trade-off because it is the part that shows judgement rather than recall. Every measure above makes the chain more expensive and less efficient. Dual sourcing raises unit costs and splits your volume so you lose bargaining power. Buffer stock is cash sitting idle. Extra channels duplicate systems and relationships. Businesses chose cost over resilience before 2020 because resilience looks like waste right up until the moment it is needed. So the real question is not whether to be resilient but how much insurance to buy and which inputs justify the premium.

B3 what steps would you take as an ethical website business owner: opening move

Everything rests on law and ethics not being the same thing. Laws grow out of ethical principles but the law is not simply a written version of them and plenty of things most people would call wrong are perfectly legal. So compliance is the floor and not the goal. The hardest decisions an online business faces are the ones that are legal but unethical because nothing outside you stops you.

B3 what steps would you take as an ethical website business owner: her four steps

Educate staff and write policies covering intellectual property and defamation and copyright and trade practices. Review the Internet regularly to see what competing sites are doing. Put properly worded disclaimers and notices at the relevant points on your site. And take advice and counsel from lawyers. These four come straight off her slide so they are the safe core of the answer and everything else is built around them.

B3 what steps would you take as an ethical website business owner: why step one matters most

Every case in the lecture came from somebody inside an organisation making an ordinary decision without realising it carried consequences. Nobody sets out to infringe a copyright. Somebody picks a music track for a video or writes a marketing email. The risk is created by normal people doing normal work which is why training and policy address the actual cause and hiring more lawyers does not.

B3 what steps would you take as an ethical website business owner: the disclaimer caution

Disclaimers are weaker than businesses assume. Writing that you are not responsible for user content does not make it true. Liability is decided by the law and by how you actually behaved rather than by what a page claims. A disclaimer helps and it is not a shield. Saying this shows you understand the step rather than just listing it.

B3 what steps would you take as an ethical website business owner: the four additions

Four more beyond her list. Check that your sourcing is responsible and your goods are genuine rather than counterfeit. Keep images and descriptions and dimensions and pricing accurate since misleading representation is the commonest way an ordinary site behaves badly without meaning to. Say plainly what data you collect and why and use opt-in rather than opt-out because almost nobody changes a default so the default is really the policy. And when you sell into other countries pick one standard and hold to the higher one instead of doing the minimum each market allows.

B3 what steps would you take as an ethical website business owner: closing move

End on timing. These decisions have to be made before you need them. An ethical business is one that has worked out where it stands in advance because at the actual moment of decision in the legal but unethical quadrant the only thing stopping you is what you already decided.

B3 what steps would you take as an ethical website business owner: the AI bridge if it appears here

If AI turns up in this question the link is the lag. AI sits in the legal but unethical quadrant right now because no law requires a company to explain an automated decision. Ethics is the only thing operating and that is exactly why she put the AI question in the ethics week.

AI critical evaluation 5 marks: evaluate fairness and accountability and transparency in AI-driven supply chains and marketing

The quote about profit versus ethical standards is printed on the paper so you respond to it rather than recall it. Take a position and cover both halves she names which are supply chains and marketing. On fairness: a model trained on past data repeats past patterns so it favours established vendors and shuts out newcomers who have no track record. On accountability: a black box produces a decision nobody can trace so the customer cannot appeal and the business cannot audit itself and a false sense of visibility is more dangerous than a known blind spot. On transparency: say where AI is used and keep a human able to overturn it. Specific examples are required. Close on the law lagging so ethics is the only constraint.