MskProdComputing
KS41CP2 4.1 to 4.2 32 min read 10 question quiz 18 exam marks

Networks and Network Security

Local and wide area networks, topologies, wired against wireless, protocols and layers, and every threat and defence Edexcel expects you to name.

Networks and topologies

A network is two or more computers connected so they can share data and resources.

A LAN covers a small area on one site, with hardware the organisation owns. A WAN covers a large geographical area, connecting sites using infrastructure hired from a provider. The internet is the largest WAN.

Network hardware

  • A network interface card provides the physical connection and the MAC address.
  • A switch joins devices on a LAN and sends each frame only to its destination.
  • A router joins networks together and directs packets between them.
  • A wireless access point allows devices to join without a cable.

Topologies

Star. Every device has its own cable to a central switch. Fast, because connections are dedicated; reliable, because one broken cable affects one device; easy to extend. More expensive, and the switch is a single point of failure.

Mesh. Every device connects to several or all others, so there are many possible routes. Extremely resilient, because traffic reroutes around a failure, and it scales well for wireless. Expensive and complex to cable in full.

Resilience against cost

A star concentrates risk at the switch and saves cable. A full mesh removes the single point of failure and pays for it in cabling. Almost every topology question is that trade off.

Wired and wireless

Wired is faster, more consistent and more secure, because interception needs physical access to the cable. It is expensive to install and the devices cannot move.

Wireless is cheap and quick to install and lets devices move freely. It is slower, degrades with distance and obstacles, is subject to interference and, by default, less secure because the signal travels through the air where anyone in range can receive it.

Star topology compared with mesh topologyTwo topologies side by side. In a star, four devices each have a single cable running to a central switch, and no device connects directly to another, so traffic always passes through the switch. If one cable fails only that one device is cut off, but if the switch fails the whole network stops. In a full mesh, five devices labelled A to E are each joined directly to all four of the others, giving ten links in total. Because there are many possible routes between any two devices, a broken link does not stop traffic, but the amount of cable needed grows very quickly.STARMESHSwitchDevice 1Device 2Device 3Device 4every device has one link to the switchone cable fails, one device is cut offABCDEevery device links to every other devicemany routes, so one broken link is survivable
In a full mesh of n devices there are n times n minus one, all divided by two links. Five devices need ten. Ten devices would need forty five.
Three network topologies: star, mesh and busThree network topologies side by side. In a star, every device has its own cable running to a central switch, so performance stays high because no device shares its cable, and a single cable failure takes out only the one device attached to it; the costs are that it needs a lot of cable and that the switch is a single point of failure for the whole network. In a mesh, every device is connected directly to every other, so any one link can fail and the data simply goes a different way, which is why the internet is built as a mesh; the cost is a great deal of cable. In a bus, every device taps into one shared backbone cable with a terminator at each end: it is cheap and needs little cable, but a break in the backbone stops everyone and all the devices share its capacity.StarMeshBusIts own cable eachOne failure drops one PCSwitch is a weak pointMany routes to takeSurvives failuresNeeds lots of cableCheap, little cableOne break stops allEveryone shares it12345
  1. Star: every device has its own cable to a central switch.
  2. If one cable fails, only that one device drops off.
  3. Mesh: every device connects to every other, with no centre at all.
  4. Any one link can fail and the data simply goes a different way.
  5. Bus: one shared backbone, and every device taps into it.
Star for a school or an office, mesh for anything that has to survive a failure. The internet is a mesh.

Protocols and layers

A protocol is a set of rules governing communication. Both ends must follow the same rules for anything to be understood.

ProtocolPurpose
EthernetWired local area networking
Wi-FiWireless local area networking
TCPSplits data into packets, checks delivery and reassembles them in order
IPAddresses packets and routes them between networks
HTTPRequests and delivers web pages
HTTPSThe same, encrypted so intercepted traffic cannot be read
FTPTransfers files between computers
SMTPSends email
IMAPRetrieves email, leaving it on the server

Layers

Protocols are organised into layers, each handling one part of the job and passing its result to the next.

LayerJob
ApplicationServices for the user's software: HTTP, FTP, SMTP, IMAP
TransportSplitting into packets and managing the connection: TCP
NetworkAddressing and routing: IP
LinkSending over the physical medium: Ethernet, Wi-Fi

Layering divides a huge problem into manageable parts, and lets any one layer be replaced without disturbing the others. Moving a laptop from Ethernet to Wi-Fi changes the link layer only: HTTP, TCP and IP carry on unchanged and no application has to be rewritten.

Layers do not make a network faster

They make it manageable, interoperable and independently changeable, and that is what the mark scheme rewards.

The four layer TCP/IP model and packet encapsulationThe four layer TCP/IP model, drawn top to bottom with the growing packet beside it. The application layer handles protocols such as HTTP, HTTPS, FTP, SMTP and IMAP, and produces the raw data. The transport layer, using TCP, splits that data into packets and adds a header carrying port numbers, so the packet is now a TCP header followed by data. The internet layer adds an IP header carrying the source and destination IP addresses, so the packet is an IP header, a TCP header and the data. The link layer, Ethernet or Wi-Fi, adds a frame header carrying MAC addresses and a frame end, giving frame header, IP header, TCP header, data, frame end. Each layer wraps the one above it in its own header, and the receiving computer unwraps the layers in reverse order.ApplicationHTTP, HTTPS, FTP, SMTP, IMAPTransportTCP splits data into packets, adds port numbersInternetIP adds source and destination IP addressesLinkEthernet or Wi-Fi, adds MAC addressessendingDataTCPDataIPTCPDataFrameIPTCPDataEndeach layer wraps the layer above in its own headerthe receiver unwraps them in the reverse order
Layers are independent. Changing from Wi-Fi to Ethernet swaps the link layer only, and nothing above it has to change.
The TCP/IP model: a message wrapped on the way down and unwrapped on the way upTwo stacks of four layers, the sender's on the left and the receiver's on the right, with the data between them. At the application layer, where HTTP, HTTPS, SMTP, IMAP and FTP live, the data is just the message. The transport layer splits it into segments and adds a TCP or UDP header carrying the port number. The internet layer wraps each segment in a packet and adds the source and destination IP addresses used for routing. The link layer wraps the packet in a frame carrying MAC addresses and a check value, and puts it on the cable or the wireless link. At the receiving computer the same four layers run in reverse: each strips off the wrapper it recognises and hands the rest up, so the application receives exactly the message that was sent. No layer needs to know how another layer does its job, which is the whole reason the model is split up this way.chatSenderchatReceiverWhat is on the wireApplicationHTTP · SMTP · DNSApplicationshows the pageDATAmessage80TransportTCP · UDP · ports80Transportputs the pieces in orderTCPDATAsegmentInternetIP · addressesInternetchecks it is for meIPTCPDATApacketLinkWi-Fi · Ethernet · MACLinkreads the frameMACIPTCPDATAFCSframecable or Wi-Fi: bits on the wire12345
  1. Your message starts at the top, in the application.
  2. Transport splits it into segments and adds a port number.
  3. Internet wraps each segment in a packet and adds IP addresses.
  4. Link turns the packet into a frame with MAC addresses, and it goes out.
  5. At the other end the same four layers run in reverse, unwrapping it.
Each layer wraps what the layer above handed it, and knows nothing about what is inside. That is why you can change the wifi for a cable without rewriting the web browser.
The same laptop on two networks: its MAC address stays, its IP address changesA laptop with a MAC address, 3C:22:FB:9A:41:7E, burned in by the manufacturer. At home the network gives it the IP address 192.168.1.23. At school the network gives it a different IP address, 10.4.7.52. The MAC address stays the same on both networks, but the IP address changes whenever it joins a different network. A table compares them. A MAC address is assigned by the manufacturer, never changes, looks like six pairs of hex digits and is 48 bits long, and is used for delivery inside one network. An IP address is assigned by the network, changes when you change network, is four numbers or 32 bits in IPv4, and is used for routing between networks.MAC 3C:22:FB:9A:41:7Eburned in by the manufacturerAt homethe network gives itIP 192.168.1.23At schoolthe network gives itIP 10.4.7.52same laptop, two networksMAC addressIP addressAssigned bythe manufacturerthe networkChanges?neverwhen you change networkLooks like6 hex pairs, 48 bits4 numbers, 32 bits (IPv4)Used fordelivery inside one networkrouting between networks123
  1. The MAC address belongs to the hardware, so it stays the same wherever the laptop goes.
  2. The IP address is given by the network, so the same laptop has a different one at home and at school.
  3. MAC: manufacturer, never changes, local delivery. IP: network, changes, routing between networks.
Think of the MAC address as a serial number and the IP address as a postal address.
How an email travels, and the difference between POP and IMAPThe journey of an email. The sender's laptop uses SMTP to send the message to the sender's mail server. SMTP is used again to pass it to the recipient's mail server. The recipient then collects it with POP or IMAP. Below, the two ways of collecting mail are compared. With POP the mail is downloaded to one device and then removed from the server, so it only exists on the device that downloaded it. With IMAP the mail stays on the server and every device, such as a phone and a laptop, shows the same mailbox, so they stay in sync.sendersender's mail serverrecipient's mail serverrecipientSMTPSMTPPOP or IMAP1POP: download, then deletemail serverone laptopdownloadremoved from the servermail is only on the device that downloaded itgood for: one device, little storage2IMAP: keep it on the servermail serverevery devicesame mailkept on the serverevery device shows the same mailboxgood for: phone and laptop together3
  1. SMTP sends email, from the sender to their server and between mail servers.
  2. POP downloads mail and normally deletes it from the server, so it lives on one device.
  3. IMAP keeps mail on the server, so a phone and a laptop both show the same mailbox.
SMTP sends. POP downloads and removes. IMAP keeps it on the server and in sync. Two devices means IMAP.

Threats and protection

Threats

Malware. Viruses attach to files and spread when those files are shared. Worms spread across a network by themselves. Trojans pretend to be legitimate software. Ransomware encrypts files and demands payment. Spyware records activity such as keystrokes.

Social engineering. Manipulating people rather than technology. Phishing sends messages impersonating a legitimate organisation to obtain details. Pretexting invents a scenario to persuade someone to hand over information. Shouldering means watching someone type a password.

Brute force attacks. Trying every possible password until one works, which is why length matters far more than complexity.

Denial of service. Flooding a server with requests so it cannot serve legitimate users.

Data interception. Capturing data as it travels across a network, which is trivial on unencrypted wireless.

SQL injection. Entering SQL into an input box that the site passes straight to its database, allowing an attacker to read or destroy data.

Protection

MeasureWhat it achieves
FirewallInspects traffic entering and leaving and blocks what is not permitted
Anti-malwareDetects and removes known malicious software
EncryptionMakes intercepted or stolen data unreadable without the key
Strong passwords and authenticationMakes guessing and brute force impractical
User access levelsLimit what one compromised account can reach
Validation of inputsPrevents SQL injection by rejecting or escaping what is entered
Penetration testingAuthorised simulated attacks that find weaknesses first
Physical securityStops somebody simply walking in and taking a machine
Software updatesClose known weaknesses before they are exploited
Say what each measure does, not just its name

Encryption does not stop data being stolen, it stops stolen data being read. A firewall does not remove malware, it blocks traffic. That precision is where the marks are.

Six cyber security threats: malware, social engineering, brute force, denial of service, SQL injection and interceptionSix common cyber security threats, one card each. Malware is software written to cause harm: a virus needs a host file, a worm spreads by itself, a trojan looks harmless, ransomware locks your files and spyware watches you. Social engineering tricks people instead of computers, for example a caller who says they are from IT and asks for a password; phishing, blagging and shouldering are all social engineering. A brute force attack tries every possible combination, for example every code from 0000 upwards, until one works. A denial of service attack floods a server with requests from many machines so that a real user cannot get through. SQL injection types database code such as ' OR '1'='1 into a form so that the database hands over names, passwords and card numbers. Data interception reads data while it travels, for example from an unencrypted wireless connection.Malware1virus: needs a host fileworm: spreads by itselftrojan: looks harmlessransomware: locks your filesspyware: watches youSocial engineering2"I'm from IT. What'syour password?"phishingblaggingshoulderingtricks people, not computersBrute force300000001....7316tries every combinationDenial of service4BUSYyoufloods it with requestsSQL injection5username' OR '1'='1namespasswordscardscode typed into a formData interception6reads data in transit
  1. Malware: virus, worm, trojan, ransomware and spyware.
  2. Social engineering: phishing, blagging and shouldering trick people instead of computers.
  3. Brute force: try every combination until one works.
  4. Denial of service: flood a server so real users cannot get in.
  5. SQL injection: database code typed into an input box.
  6. Interception: reading data as it travels, for example on public Wi-Fi.
Every threat has a matching defence. Learn them as pairs: the picture on the next page of defences shows which goes with which.
Layers of defence around encrypted data, and the defence that answers each threatDefence in depth drawn as rings around the data. From the outside in the rings are physical security, a firewall, anti-malware software, user access levels, and passwords with two factor authentication, and at the centre the data itself is encrypted. An attacker has to get through every layer. On the right each threat is matched with its defence: brute force is stopped by a long password, two factor authentication and a limit on login attempts; phishing by staff training and spam filters; malware by anti-malware software that is kept up to date; SQL injection by validating every input; interception by encrypting the data; and unauthorised access by a firewall and user access levels.Physical securityFirewallAnti-malwareAccess levelsPasswords and 2FAencrypted dataDefence for each threatBrute forcelong password, 2FA, limit triesPhishingstaff training, spam filtersMalwareanti-malware, keep it updatedSQL injectionvalidate every inputInterceptionencrypt the dataUnauthorised accessfirewall, access levels12
  1. No single defence is enough, so several layers are used. An attacker has to get past all of them.
  2. Match each threat to the defence that answers it. This pairing is asked in the exam.
Encryption does not stop data being intercepted. It makes intercepted data useless.
Three passwords compared by how many guesses an attacker needsThree passwords, each with the number of possibilities an attacker must search and how long that takes at a billion guesses a second. The first, sunny, is a common word, so it is found from a word list in under a second. The second, k7$Rm2!x, is eight random characters chosen from 95 symbols, which is about 6.6 quadrillion possibilities and takes about 77 days. The third, river-dust-lamp-oak-fern, is five random words from a list of 7776 words, which is about 2.8 times 10 to the 19, and takes about 900 years. Length matters more than cleverness, because every extra character multiplies the number of possibilities, and a password should never be reused.At a billion guesses a second1sunnya common word12 million possibilities26 letters, 5 placescracked inunder a second2k7$Rm2!x8 random characters6.6 quadrillion possibilities95 symbols, 8 placescracked inabout 77 days3river-dust-lamp-oak-fern5 random words2.8 × 10^19 possibilitiesa 7776 word list, 5 wordscracked inabout 900 yearsLonger beats clever: every extra character multiplies the work.Never reuse a password, and add two factor authentication so that a stolen password is not enough.Bar length shows how many digits the number of possibilities has.
  1. A common word is cracked at once, however long it feels to type.
  2. Eight random characters from 95 symbols: about 6.6 quadrillion possibilities.
  3. Five random words from a list: far more possibilities, and easier to remember.
A strong password is long, random and used once. Add two factor authentication for anything that matters.

Key terms you must be able to define

LAN
Local area network, covering one site with hardware the organisation owns.
WAN
Wide area network, spanning sites using hired infrastructure.
Switch
A device joining computers on a LAN and forwarding each frame only to its destination.
Router
A device joining networks together and directing packets between them.
Star topology
A layout in which every device has its own cable to a central switch.
Mesh topology
A layout in which devices connect to several or all others, giving many routes.
Protocol
A set of rules governing how devices communicate.
Layer
One level of a networking model, handling one part of the communication task.
Phishing
Sending messages that appear legitimate in order to obtain confidential details.
Brute force attack
Trying every possible password until the correct one is found.
Denial of service
Flooding a server with requests so that it cannot serve legitimate users.
SQL injection
Entering SQL into an input field so that it is executed by the site's database.

Flashcards

Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.

DefineLAN
AnswerLocal area network, covering one site with hardware the organisation owns.
DefineWAN
AnswerWide area network, spanning sites using hired infrastructure.
DefineSwitch
AnswerA device joining computers on a LAN and forwarding each frame only to its destination.
DefineRouter
AnswerA device joining networks together and directing packets between them.
DefineStar topology
AnswerA layout in which every device has its own cable to a central switch.
DefineMesh topology
AnswerA layout in which devices connect to several or all others, giving many routes.
DefineProtocol
AnswerA set of rules governing how devices communicate.
DefineLayer
AnswerOne level of a networking model, handling one part of the communication task.

Reach the top grade on this topic

Network questions reward causal reasoning and precise vocabulary.

Name the threat exactly. Phishing, pretexting, brute force, denial of service and SQL injection are distinct named threats, and the exam expects the right word for the scenario.

Match the defence to the threat in the question. A stolen laptop needs encryption and physical security. Staff clicking links needs training and filtering. An input box needs validation. Listing every measure you know earns fewer marks than choosing two and justifying them.

Explain layering with an example of change. Swapping Wi-Fi for Ethernet changes the link layer and nothing above it, so no application needs rewriting. That single example demonstrates the whole idea.

Mistakes that cost marks here

Avoid these
  • Calling every attack 'hacking' rather than naming the specific threat.
  • Swapping SMTP and IMAP. SMTP sends, IMAP retrieves.
  • Saying encryption prevents data being stolen. It prevents stolen data being read.
  • Saying layering makes a network faster.
  • Confusing a switch with a router.
Fun fact

The first message ever sent over the network that became the internet was meant to be the word LOGIN. The system crashed after two characters, so the first thing ever transmitted was LO.

Knowledge check

0 of 10 answered
1What is the main difference between a LAN and a WAN?
2Which protocol is used to retrieve email while leaving it on the server?
3What is the advantage of a mesh topology?
4What is a brute force attack?
5What does a denial of service attack do?
6How does validation of inputs help prevent SQL injection?
7Which layer does IP operate at?
8Why is wireless less secure than wired by default?
9What does a firewall do?
10A laptop is moved from a wired connection to Wi-Fi and every application still works. Which principle does this show?
Score 0 / 10

Exam-style questions

Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.

18 marks
1State two items of network hardware and describe the purpose of each.4 marks
State

Mark scheme0 / 4
  • LNames a switch
  • LDescribes it as joining devices on a LAN and sending frames to their destination
  • LNames a router
  • LDescribes it as joining networks and directing packets between them
Model answer

A switch joins the devices on a local area network together and forwards each frame only to the device it is addressed to, which keeps traffic off the rest of the network. A router joins separate networks together and directs packets between them, deciding which route each packet should take, which is what connects a local network to the internet.

The marker looks for key phrases. If you said it another way and it is still right, give yourself the mark.
2Explain why network protocols are organised into layers.4 marks
Explain

Mark scheme0 / 4
  • LEach layer handles one part of the communication task
  • LSo a very complex problem is broken into manageable pieces
  • LA layer can be changed without affecting the layers above and below it
  • LGives an example such as swapping Ethernet for Wi-Fi
Model answer

Layering divides the problem of network communication into parts, each of which handles one aspect and interacts only with the layer directly above and below it. That means nobody has to understand the whole of networking at once, and different specialists can work on different layers. It also gives independence: because each layer only depends on the interface the next presents, one can be replaced entirely without disturbing the others. Moving a laptop from an Ethernet cable to Wi-Fi replaces the link layer completely, yet IP, TCP and HTTP carry on exactly as before and no application has to be rewritten.

The marker looks for key phrases. If you said it another way and it is still right, give yourself the mark.
3An online shop finds that an attacker has read its entire customer table by typing text into the site's search box. Name the attack and explain how it could be prevented.4 marks
Name

Mark scheme0 / 4
  • LNames SQL injection
  • LExplains that text entered by the user is being executed as part of a database query
  • LPrevention by validating or sanitising input
  • LOr by using parameterised queries, and limiting the database account's permissions
Model answer

This is SQL injection. It happens because whatever the user types into the search box is being joined directly into an SQL query and sent to the database, so an attacker can type SQL of their own and have the database execute it, returning data the page was never meant to show. The primary prevention is to stop user input ever being treated as code: use parameterised queries, so the database is told in advance which part of the statement is a value and which is an instruction. Alongside that, input should be validated against what a search term is actually allowed to contain, and the account the website uses to reach the database should have only the permissions the site genuinely needs, so that even a successful injection cannot read the whole customer table.

The marker looks for key phrases. If you said it another way and it is still right, give yourself the mark.
4A school is choosing between a star and a mesh topology for a new building. Discuss the advantages and disadvantages of each, and make a recommendation.6 marks
Discuss

Mark scheme0 / 6
  • LA star gives each device a dedicated connection to a central switch
  • LSo it is fast and one cable failure affects only one device
  • LBut the switch is a single point of failure for the whole network
  • LA mesh provides multiple routes between devices
  • LSo it is very resilient, but expensive and complex to cable in full
  • LReaches a justified recommendation for this situation
Model answer

A star topology gives every device its own cable running to a central switch. Nothing is shared, so devices do not compete for the medium and performance stays consistent as machines are added, and a damaged cable disconnects only the one device on it. Extending the network means running one more cable. Its weakness is concentration of risk: everything passes through the switch, so if the switch fails the entire network stops until it is replaced. A mesh topology connects devices to several or all of the others, so there are multiple routes between any two points and traffic can be rerouted automatically around a broken link or a failed device. That resilience is genuine, but a full wired mesh needs an enormous amount of cable, which becomes impractical very quickly: ten devices would need forty five separate links. For a school building the recommendation is a star, and for two reasons specific to the situation. The cost and complexity of a wired mesh cannot be justified for classroom machines where a short outage is inconvenient rather than dangerous, and the failure the school is most likely to experience is a damaged patch lead, which a star already handles. The single point of failure should be managed rather than designed out: keep a spare switch on site, and if the school later adds wireless coverage across the building, a wireless mesh of access points is a sensible way to get resilience where cabling would be difficult.

The marker looks for key phrases. If you said it another way and it is still right, give yourself the mark.
Machine mark 0 / 18