Network security

Sits where the network meets the outside world and inspects every packet crossing it, allowing or dropping each one by rule — on outgoing traffic as well as incoming.

A whitelist allows only what is listed and blocks everything else: safe by default but restrictive. A blacklist blocks only what is listed: convenient, but anything not yet known about gets through, so it is always a step behind.

They stop an already-infected machine sending stolen data out or contacting whoever controls it. Most answers mention only incoming traffic, so this is a reliable extra mark.

Traffic that never crosses it, such as malware on a USB stick or one internal machine infecting another; the contents of encrypted connections, which it cannot read; and attacks delivered over ports the rules legitimately allow.

Internal machines have private addresses that are not routable, so nothing outside can address them directly — only reply to conversations they start. But NAT does nothing about outgoing traffic, what an allowed connection carries, or anything inside the network.

A **vulnerability** is the weakness. An **attack** is someone using it. A **threat** is the person or group who might.

A **virus** needs a user to run the infected file. A **worm** spreads **by itself** across a network, which is why it moves so fast.

**Unencrypted** traffic passing the attacker's machine. Encryption makes what is captured unreadable.

It is **distributed** — traffic arrives from many machines at once, usually ordinary computers that were themselves compromised.

**Urgency defeats caution** and authority is rarely questioned. One person in a thousand clicking is enough, and emailing thousands costs nothing.

Layered controls, so that **one failing does not end the matter** — assume the firewall will eventually be got past.

**Multi-factor authentication.** It turns a stolen password into a failed login, and stolen passwords cause most breaches.

Anything **already inside**, and anything carried over a connection it was configured to **allow** — such as malware in ordinary web traffic.

An untested backup fails when needed, and one reachable from the network can be **encrypted by ransomware along with everything else**.

People **work around** what they cannot follow — writing passwords down, using personal accounts, and not reporting mistakes.

Symmetric uses one key to both lock and unlock — fast, but the key must reach the other end safely. Asymmetric uses two matched keys: a public one anyone may have and a private one that never leaves, so nothing secret has to travel.

For confidentiality, the recipient's public key encrypts and only their matching private key can decrypt. That is why the public key can be handed to anyone without weakening anything.

An organisation's public key together with its identity, signed by a certificate authority the browser already trusts. It proves the public key really belongs to who it claims, which a bare public key cannot.

Asymmetric solves the problem of agreeing a key safely but is slow. So it is used once to agree a symmetric key, and all the actual traffic is then encrypted symmetrically because that is much faster for bulk data.

Keys must be generated properly, stored where nobody else can reach them, replaced periodically and revoked immediately if they leak. A private key that escapes makes every message ever sent with it readable, however strong the algorithm.