Networks and Cyber Security
How computers talk to each other, what happens when you type a web address, and the attacks and defences you need to understand.
Networks
A network is two or more computers connected so they can share data and resources.
LAN and WAN
- LAN, local area network, covers a small area such as one school or one house, and the organisation owns the equipment.
- WAN, wide area network, covers a large area such as a whole country. The internet is the largest WAN in the world.
Why network computers
- Share files and work
- Share hardware such as printers, which saves money
- Share one internet connection
- Back up everything centrally
- Manage user accounts and updates from one place
The downsides are the cost of setting it up, the fact that malware spreads quickly across a network, and that if the server fails everyone is affected.
The hardware
| Device | Job |
|---|---|
| Router | Connects different networks together and directs data between them |
| Switch | Connects devices within one network and sends data only to the right device |
| NIC | Network interface card, letting a device connect to a network at all |
| WAP | Wireless access point, letting devices connect without cables |
| Server | A powerful computer that provides files, web pages or other services |
Wired and wireless
| Wired | Wireless | |
|---|---|---|
| Speed | Faster and more consistent | Slower and more variable |
| Reliability | Very reliable | Signal weakens with distance and through walls |
| Security | More secure, physical access needed | Less secure, signal travels through the air |
| Convenience | Devices cannot move | Devices can move freely |
- Star: every device has its own cable to a central switch.
- If one cable fails, only that one device drops off.
- Mesh: every device connects to every other, with no centre at all.
- Any one link can fail and the data simply goes a different way.
- Bus: one shared backbone, and every device taps into it.
The internet and the web
The internet is the global network of connected computers. The World Wide Web is one service that runs on it, made of web pages linked together. Email, streaming and online gaming also run on the internet but are not part of the web.
What happens when you type an address
- You type
www.example.cominto a browser. - Your computer asks a DNS server to look up the IP address for that name, because computers route by number, not by name.
- DNS replies with something like
93.184.216.34. - Your computer sends a request to that address.
- The web server sends back the page, broken into packets.
- Packets travel by different routes and may arrive out of order.
- Your computer reassembles them in the right order and the browser displays the page.
Packets
Data is split into small packets. Each contains:
- Part of the data
- The destination address
- The sender's address
- A packet number, so they can be reassembled in order
Splitting data up means a single large file cannot block the network, and if one packet is lost only that packet needs resending rather than the whole file.
IP addresses and protocols
An IP address identifies a device on a network. A protocol is a set of rules for how data is sent, so that different computers can understand each other.
- HTTP transfers web pages
- HTTPS does the same but encrypted, so intercepted data cannot be read
- TCP/IP splits data into packets, addresses them and makes sure they all arrive
- SMTP sends email, and IMAP retrieves it
- You type an address. The browser needs the IP address behind the name.
- A DNS server looks up the name and returns the IP address.
- The browser sends an HTTP request to that address.
- The server sends back HTML, CSS, images and scripts.
- The browser renders them into the page you see.
- SMTP sends email, from the sender to their server and between mail servers.
- POP downloads mail and normally deletes it from the server, so it lives on one device.
- IMAP keeps mail on the server, so a phone and a laptop both show the same mailbox.
Cyber security
Threats
| Threat | How it works |
|---|---|
| Virus | Attaches to a file and spreads when that file is opened or shared |
| Worm | Spreads across a network by itself, with no user action needed |
| Trojan | Pretends to be useful software so the user installs it willingly |
| Ransomware | Encrypts your files and demands payment to unlock them |
| Spyware | Secretly records what you do, including what you type |
| Phishing | A fake message tricking you into giving away your details |
| Brute force | Trying millions of password combinations automatically |
| DoS attack | Flooding a server with requests so real users cannot get through |
Defences
| Defence | What it does |
|---|---|
| Anti malware software | Scans files against known threats and removes them. Must be kept updated. |
| Firewall | Checks traffic entering and leaving the network and blocks anything against its rules |
| Strong passwords | Long and unguessable, defeating brute force attacks |
| Two factor authentication | A stolen password alone is not enough to log in |
| Encryption | Scrambles data so intercepted information cannot be read |
| User access levels | Each person can only reach what their role needs |
| Backups | Data can be restored after ransomware or hardware failure |
| Software updates | Close the security holes that malware exploits |
It makes intercepted data useless, because without the key it is meaningless. That distinction matters, and it earns marks.
The weakest point is always a person
The most sophisticated firewall in the world cannot stop an employee who types their password into a convincing fake login page. This is why training is a genuine security measure, not an afterthought.
- Malware: virus, worm, trojan, ransomware and spyware.
- Social engineering: phishing, blagging and shouldering trick people instead of computers.
- Brute force: try every combination until one works.
- Denial of service: flood a server so real users cannot get in.
- SQL injection: database code typed into an input box.
- Interception: reading data as it travels, for example on public Wi-Fi.
- No single defence is enough, so several layers are used. An attacker has to get past all of them.
- Match each threat to the defence that answers it. This pairing is asked in the exam.
Key terms you must be able to define
- Network
- Two or more computers connected so they can share data and resources.
- LAN
- Local area network, covering a small area with hardware owned by the organisation.
- WAN
- Wide area network, covering a large geographical area. The internet is the largest.
- Router
- A device that connects different networks and directs data between them.
- Switch
- A device that connects computers within one network and sends data only to the intended device.
- Packet
- A small piece of data sent across a network, containing addresses and a sequence number.
- IP address
- A number identifying a device on a network.
- DNS
- The Domain Name System, which converts a web address into an IP address.
- Protocol
- A set of rules governing how data is sent between devices.
- Encryption
- Scrambling data with a key so it cannot be understood by anyone who intercepts it.
- Firewall
- Hardware or software that inspects network traffic and blocks anything against its rules.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
The top level here is about explaining mechanisms.
Say what a device actually does. Not "a router connects to the internet", but "a router connects two different networks and uses IP addresses to decide where each packet should be sent next".
Explain why packets are used. Because a large file split into packets cannot block the network for everyone else, and because if one packet is lost only that packet has to be resent.
Match the defence to the threat. A firewall does not stop phishing, because phishing works on the person rather than the network. The defence there is training.
- Explain the difference between the internet and the World Wide Web
- Describe what happens between typing a web address and the page appearing
- Explain the difference between a virus and a worm
- Match any threat to the defence that actually addresses it
Mistakes that cost marks here
- Using the words internet and web as if they mean the same thing.
- Saying a switch and a router do the same job. A switch works inside one network, a router works between networks.
- Saying encryption stops data being intercepted. It stops it being understood.
- Recommending antivirus software as the defence against phishing, which attacks the person rather than the machine.
- Saying a virus and a worm are the same. A worm spreads on its own with no user action.
When you load a web page, the data is broken into packets that may each take a completely different route across the world and arrive out of order. Your computer reassembles them so fast that it looks instant.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LA LAN covers a small area and a WAN covers a large geographical area
- LLAN equipment is owned by the organisation, WAN infrastructure is not
A LAN covers a small geographical area such as a single school or house, whereas a WAN covers a large area and may span whole countries, with the internet being the largest example. In addition, the organisation using a LAN owns all of the cabling and hardware itself, while a WAN uses infrastructure belonging to other companies.
- LThe browser asks a DNS server to look up the address
- LDNS returns the IP address of the web server
- LA request is sent to that IP address and the server responds
- LThe page is sent as packets which are reassembled by the browser
When the user presses enter, the browser first needs to turn the human readable address into a number, because networks route data by IP address rather than by name. It therefore sends a request to a DNS server, which looks the name up and returns the IP address of the web server. The browser then sends a request to that IP address asking for the page. The web server responds by sending the page back, but the data is split into small packets, each carrying a sequence number and the destination address. These packets may travel by different routes and arrive out of order, so the receiving computer uses the sequence numbers to reassemble them correctly before the browser displays the finished page.
- LLarge files would otherwise block the network for other users
- LPackets can take different routes, using the network efficiently
- LIf a packet is lost only that packet needs resending, not the whole file
Splitting data into packets means that a single very large file cannot occupy a connection completely and block everyone else, because packets from different transfers can be interleaved and the network is shared fairly. Packets can also travel by different routes depending on which parts of the network are congested, which uses the available capacity efficiently and means a fault on one route does not stop the transfer. Finally, if a packet is damaged or lost in transit, only that individual packet has to be sent again rather than the entire file, which is far quicker and far less wasteful.
- LInstall anti malware software
- LKeep it updated so new threats are recognised
- LUse a firewall to filter network traffic
- LRestrict user access levels so students cannot install software
- LTrain staff and students to recognise suspicious emails and links
- LKeep backups so data can be restored if it is encrypted or lost
The first measure is to install anti malware software on every computer and set it to update automatically. This scans files against a database of known malware and removes or quarantines anything it finds, but because new malware appears constantly the software is only effective if that database is kept current. The second measure is to use a firewall between the school network and the internet. A firewall examines all the traffic going in and out and blocks anything that does not match its rules, which stops many threats reaching the network at all and prevents malware that does get in from communicating with outside servers. The third measure is to set user access levels so that students, and most staff, cannot install software or change system files. That means that even if someone is tricked into running something harmful, it only has the limited permissions of that account and cannot spread across the whole system. Alongside these, training people to recognise suspicious emails addresses the route most infections actually take, and keeping regular backups means that if ransomware does encrypt the school's files they can be restored rather than paid for.
- LEncryption scrambles data using a key
- LWithout the key the data cannot be understood
- LIt does not prevent interception, it makes intercepted data useless
Encryption scrambles data using a key so that what is actually transmitted is a meaningless sequence of characters. Only someone who has the correct key can convert it back into the original information, so an attacker who captures the traffic cannot understand any of it. Encryption does not prevent data from being intercepted: anyone in a position to capture the traffic can still capture it. What encryption does is make that interception pointless, because the attacker ends up with data they cannot read.