Network security

Sits where the network meets the outside world and inspects every packet crossing it, allowing or dropping each one by rule — on outgoing traffic as well as incoming.

A whitelist allows only what is listed and blocks everything else: safe by default but restrictive. A blacklist blocks only what is listed: convenient, but anything not yet known about gets through, so it is always a step behind.

They stop an already-infected machine sending stolen data out or contacting whoever controls it. Most answers mention only incoming traffic, so this is a reliable extra mark.

Traffic that never crosses it, such as malware on a USB stick or one internal machine infecting another; the contents of encrypted connections, which it cannot read; and attacks delivered over ports the rules legitimately allow.

Internal machines have private addresses that are not routable, so nothing outside can address them directly — only reply to conversations they start. But NAT does nothing about outgoing traffic, what an allowed connection carries, or anything inside the network.

Symmetric uses one key to both lock and unlock — fast, but the key must reach the other end safely. Asymmetric uses two matched keys: a public one anyone may have and a private one that never leaves, so nothing secret has to travel.

For confidentiality, the recipient's public key encrypts and only their matching private key can decrypt. That is why the public key can be handed to anyone without weakening anything.

An organisation's public key together with its identity, signed by a certificate authority the browser already trusts. It proves the public key really belongs to who it claims, which a bare public key cannot.

Asymmetric solves the problem of agreeing a key safely but is slow. So it is used once to agree a symmetric key, and all the actual traffic is then encrypted symmetrically because that is much faster for bulk data.

Keys must be generated properly, stored where nobody else can reach them, replaced periodically and revoked immediately if they leak. A private key that escapes makes every message ever sent with it readable, however strong the algorithm.