3.5 - Network security methods

Why networks need protection

A network provides routes for legitimate communication, but those routes can also expose devices and data to attacks.

An attacker might read private messages, alter files, impersonate an authorised user or prevent access to a shared service. In a medical clinic, leaked records could harm patients' privacy, changed records could lead to incorrect decisions, and an unavailable appointment system could disrupt care. Security therefore protects confidentiality, the correctness of data and the availability of services. These are related purposes, rather than three names for the same harm.

Protection matters inside an organisation as well as at its Internet connection. A member of staff should not automatically gain access to every record simply because the staff computer is on the network. Equally, a secure login does not by itself protect a message while it travels across a connection.

Authentication, encryption, firewalls and MAC filtering

Each security method answers a different question about an attempted communication.

Authentication checks a claimed identity, for example through an account password or a biometric check. A clinic can require a staff login before opening its record system. Once the identity is authenticated, access rights determine what that person may do. Checking identity and deciding permissions are related but different steps.

Encryption transforms readable data into an unreadable form using a key; authorised decryption recovers the original data. It helps protect intercepted network traffic. For example, HTTPS encrypts a web transaction carrying a staff login. Encryption protects data in transit, but cannot stop an authorised recipient from misusing the decrypted information.

A firewall could block unwanted incoming connections while allowing required web traffic. Rules may consider properties such as addresses or the service requested. It checks traffic against its rules; it does not simply “block the Internet”, and allowed traffic can still contain a threat that the rules do not recognise.

MAC address filtering permits or blocks devices using the physical address associated with their network adapter. A small organisation might allow only listed staff devices to join its network. This identifies an adapter rather than proving the identity of the person using it. An attacker may imitate an allowed address, so it is not a complete defence.