Network security is any activity designed to protect a network and its data from internal and external threats.
Networks hold valuable data: customers’ personal and payment details, staff records, money, designs and plans.
If security fails, data can be stolen, changed or deleted, and the network may be unavailable for days.
Then the organisation may lose money and customers’ trust, and can be fined for not protecting personal data (the law is in the issues and impact topic).
Internal threats (from inside)
External threats (from outside)
A member of staff who steals or deletes data, for example after being sacked
Criminal hackers trying to get in from the internet
Careless staff: weak passwords, leaving a computer logged on, plugging in an infected USB stick
Competitors, or other organisations, wanting trade secrets
Staff looking at data they have no reason to see
Thieves who break into the building to take equipment
Exam tipName a real consequence for the organisation in the question: ‘patients’ medical records could be read by criminals and used for fraud’ beats ‘data could be hacked’.
Network security
Any activity designed to protect a network and its data from internal and external threats.
Internal threat
A threat from inside the organisation, such as a careless or dishonest employee.
External threat
A threat from outside the organisation, such as a criminal hacker.
Edexcel 1CP2 · 4.2.1
Network vulnerabilities
A network vulnerability is a weakness that can be exploited by a criminal to gain unauthorised access to information or resources.
Vulnerability
Why it’s a weakness
Weak passwords
Short or common passwords (or ones never changed from the default) are easy to guess or crack.
Poorly configured firewall
Rules that allow too much traffic in or out let attackers through.
Unpatched devices and software
Known security flaws haven’t been fixed, so attackers know exactly how to get in.
Too many permissions
Users who can read or delete files they don’t need make it easier for one stolen account to do a lot of damage.
Old accounts left open
Accounts of people who have left can still be used to log in.
Unlocked equipment
Anyone walking past an open server room can plug in a device or take a disk.
Exam tipA vulnerability is the weakness, not the attacker or the attack. ‘A hacker’ is a threat; ‘a password that is only four letters long’ is a vulnerability.
Network vulnerability
A weakness that can be exploited by a criminal to gain unauthorised access to information or resources.
Edexcel 1CP2 · 4.2.1
Penetration testing
Penetration testing is an authorised, simulated attack on a network or system, carried out to find its vulnerabilities so they can be fixed.
The organisation agrees in writing what may be tested and when. Without permission, the same actions would be illegal.
Testers try the methods a real attacker would use, record every weakness they find, and report them with advice on fixing them.
After the fixes, the network is tested again. Testing is repeated regularly, because new vulnerabilities appear.
White box (internal) testing
Black box (external) testing
What the tester is given
Details of the system: network diagrams, and often a user login
Nothing: no details and no login
Which attacker it simulates
An insider, such as an employee or someone who has stolen a login
An outside hacker with no inside knowledge
What it finds
What a person with access could reach or damage
How easily an outsider could get in
White box testers know the system; black box testers don’t
Exam tip‘Hacking into the network’ gets nothing on its own. Include both key ideas: it is authorised (the organisation asked for it), and its purpose is to find vulnerabilities so they can be fixed.
Penetration testing
An authorised, simulated attack on a network to find vulnerabilities so they can be fixed.
White box testing
Internal penetration testing: the tester has details of the system and credentials, simulating an insider.
Black box testing
External penetration testing: the tester has no details or credentials, simulating an outside hacker.
Edexcel 1CP2 · 4.2.1
Ethical and criminal hackers
Hackers use the same skills. What separates them is permission and purpose.
Ethical hackers are often employed or hired by the organisation, and carry out penetration tests.
They help the organisation to see its network the way an attacker would, so it can fix weaknesses before they are exploited.
Ethical (white-hat) hacker
Criminal (black-hat) hacker
Permission
Authorised by the organisation that owns the network
No permission: unauthorised access is a crime
Purpose
Find vulnerabilities and report them, so they can be fixed before criminals find them
Steal, change or destroy data; demand money; cause disruption
What happens to the weaknesses found
Reported to the owner, kept confidential
Exploited, or sold to other criminals
Exam tipEthical hackers do not ‘hack the hackers back’ or attack criminals. Their job is to test their client’s own network, with permission, and report what they find.
Ethical (white-hat) hacker
A hacker authorised by an organisation to find and report vulnerabilities in its network.
Criminal (black-hat) hacker
A hacker who gains unauthorised access to systems to cause harm or for gain.
Edexcel 1CP2 · 4.2.1
Access control and authentication
Access control keeps unauthorised users and devices from getting into a network, and restricts what authorised users are allowed to do.
Authentication is checking that users are who they say they are, usually with a username and password.
Strong password rules: a long password, mixing letters, digits and symbols; not a dictionary word or personal detail; never reused; the account locks after several wrong attempts.
Multi-factor authentication (MFA) asks for two or more different kinds of evidence: something you know (password), something you have (a code sent to a phone, a security key), something you are (a fingerprint).
Why MFA is more secure: a criminal who steals or guesses the password still can’t log in, because they would also need the user’s phone or fingerprint.
After authentication, file permissions decide what each user can do (next section).
Each factor is a different kind of evidence
Exam tipTwo passwords, or a password and a PIN, are not multi-factor: both are things you know. The factors must be different kinds.
Access control
Keeping unauthorised users and devices out of a network and restricting what authorised users can do.
Authentication
Checking that a user is who they claim to be, e.g. with a username and password.
Multi-factor authentication
Authentication that needs two or more different kinds of evidence: something you know, have or are.
Edexcel 1CP2 · 4.2.1
File permissions
File permissions control what data each network user can access, and what they can do with it. The operating system enforces them.
Give each user only the permissions they need for their job. Then a careless user can’t damage files they don’t use, and a stolen account can reach much less.
Permissions are usually set for groups (for example ‘Finance’, ‘Teachers’, ‘Students’), so a new user just joins the right group.
Permission
Lets the user…
Read
open and view a file (but not change it)
Write
change a file’s contents and save it, or create new files
Delete
remove a file
Execute
run a file, such as a program
Worked exampleA gym’s shared drive has a folder of members’ payment records. Who should have which permissions?
Accounts manager: read, write and delete.Their job is to keep the records up to date.
Receptionists: read only.They need to check whether a member has paid, but not change the records.
Personal trainers: no access.Their job doesn’t need payment data.
Each group gets the least access it needs to do its job.
File permissions
Settings (read, write, delete, execute) that control what each user can do with each file or folder.
Edexcel 1CP2 · 4.2.1
Physical security
Physical security stops unauthorised people getting physical access to network components such as servers, switches and desktop computers.
Why it matters: someone standing next to a server can steal it or its disks, plug in a device to copy data or add malware, or simply switch it off. A firewall can’t stop any of this.
Method
How it keeps people out
Locks on server rooms and cabinets
Only people with a key can reach the equipment
Key cards or biometric locks (fingerprint) on doors
Only authorised staff can open the door, and each entry can be logged
Security staff and visitor sign-in
Strangers are challenged and escorted
CCTV
Deters intruders and records who entered
Alarms and motion sensors
Warn staff when someone enters out of hours
Exam tipLink the method to preventing unauthorised physical access: ‘a key-card lock on the server room door means only the technicians can get in, so no one else can steal or tamper with the server’. Don’t give a firewall or a password as physical security, and don’t repeat a method the question has already given.
Physical security
Methods that stop unauthorised people getting physical access to network components.
Edexcel 1CP2 · 4.2.1
Firewalls
A firewall protects a network by monitoring incoming and outgoing traffic and using a set of rules to decide which traffic to allow in and out, and which to bar.
It sits between the organisation’s network and the internet. It can be a separate hardware device, software on each computer, or built into a router.
Rules can be based on where traffic comes from or goes to (IP addresses), what kind of traffic it is, and whether it is a reply to a request made from inside.
For example: allow replies to web pages staff have asked for; block all other incoming connections; block a known attacker’s IP address; stop outgoing traffic to banned websites.
Barred traffic is dropped, and the attempt can be logged so technicians can see attacks.
Limits: a firewall with badly set rules lets attackers through; it can’t stop a threat from inside the network or one that arrives through traffic the rules allow.
Every packet in or out is checked against the rules
Exam tip‘A firewall monitors traffic’ is only half an answer, and ‘it stops hacking’ earns nothing. Say it checks incoming and outgoing traffic against a set of rules and blocks what the rules don’t allow.
Firewall
Hardware or software that monitors incoming and outgoing traffic and uses a set of rules to decide what to allow and what to bar.
Edexcel 1CP2 · 4.2.1
Putting it together: protecting a network
No single method is enough. Organisations use layers, so an attacker who gets past one still meets the next.
In a Discuss question, cover every bullet you’re given. For each method, say what it is, how it would work in that organisation, and why it matters there.
Point out weaknesses or trade-offs too, for example: MFA slows down logging in; very strict permissions can get in the way of people doing their jobs.
Method
What it stops
What it can’t stop on its own
Physical security
Theft of, or tampering with, the equipment
Attacks over the internet
Firewall
Unwanted traffic from the internet
Insiders; attacks through allowed traffic
Authentication and MFA
People without a valid login (and stolen passwords, with MFA)
What an authorised user then does
File permissions
Users reaching or changing data they don’t need
Someone who gets an account that has broad permissions
Penetration testing and ethical hacking
Weaknesses staying hidden
Nothing by itself: the weaknesses must then be fixed
Each layer stops a different kind of attack
Exam tipIn a 6-mark Discuss, a list of method names stays in Level 1. Level 3 needs every bullet covered, with linked reasons that clearly apply to the scenario.
Layers of protection
Using several security methods together, so one failing doesn’t leave the network open.
Genious