Security Defences: Firewalls, Proxies & SSL/TLS

As the volume and sophistication of cyber threats escalate, relying on a single security barrier is insufficient. Modern cybersecurity strategies employ defense-in-depth—a layered model combining network perimeter filters, intermediary servers, encryption, and robust multi-factor authentication.

Learning Objectives

• Describe the operation and packet-filtering capabilities of Firewalls.
• Explain the role, benefits, and operation of Proxy Servers.
• Compare authentication mechanisms: Passwords, Biometrics, and Two-Factor Authentication (2FA).
• Explain how layered security defences safeguard computer networks against unauthorized access.

1. Firewalls

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules.

[ UNTRUSTED INTERNET ] <=====> [ FIREWALL (Packet Filter) ] <=====> [ SECURE PRIVATE LAN ]
                               - Check Source/Dest IP
                               - Check Port Numbers (80, 443)
                               - Check Protocols (TCP/UDP)
                               - BLOCK Unauthorized Traffic!

How a Firewall Operates:

• Packet Filtering: The firewall inspects every incoming and outgoing packet's header:
• IP Addresses: Blocks packets originating from known malicious or blacklisted IP addresses.
• Port Numbers: Blocks unauthorized ports (e.g. closing Telnet port 23 or FTP port 21 while leaving web port 443 open).
• Protocols: Permits only approved protocols (such as HTTP, HTTPS, or SSH).
• Hardware vs Software Firewalls:
• Hardware Firewall: A physical dedicated gateway appliance placed between the modem/router and the internal network switch. Protects every device connected to the network simultaneously without consuming client CPU.
• Software Firewall: A program installed on individual operating systems (e.g. Windows Defender Firewall), filtering traffic entering and exiting that specific machine.

2. Proxy Servers

A proxy server is an intermediary server that sits between client computers on a private network and the public internet.

[ Client PC ]  ---- Request Page ---->  [ PROXY SERVER ]  ---- Forward Request ---->  [ Web Server ]
192.168.1.10                           (Public IP: 203.0.113.5)                        (Sees only Proxy IP!)

Core Benefits of a Proxy Server:

1. IP Masking (Anonymity & Security):

• When a user visits an external website, the proxy server replaces the client's internal IP address with its own external IP address.
• The remote web server never learns the internal identity or network topology of the client computer, insulating internal devices from direct attack.

1. Web Caching (Speed & Bandwidth Conservation):

• The proxy stores cached copies of frequently requested web pages and assets locally.
• When another user on the network requests the same website, the proxy serves it instantly from its local high-speed cache, saving valuable external internet bandwidth and reducing page load times.

1. Content Filtering & Access Control:

• Schools and businesses configure proxy servers to block access to unauthorized categories of websites (such as gambling, social media, or gaming sites) by intercepting and rejecting forbidden domain requests.

3. Authentication & Access Control

Authentication verifies that a user attempting to access a system is genuinely who they claim to be.

Authentication Factors:

Authentication methods fall into three distinct categories:

1. Something You Know: Passwords, PINs, security questions.
2. Something You Have: Physical security keys (YubiKey), smartphones running authenticator apps (TOTP), SMS verification codes, smart cards.
3. Something You Are (Biometrics): Biological physical characteristics unique to an individual:

• Fingerprint scanning (capacitive or optical).
• Facial recognition (3D infrared depth sensors).
• Iris / Retina scanning.
• Voiceprint analysis.

4. Two-Factor Authentication (2FA) / Multi-Factor Authentication (MFA)

Traditional single-factor authentication (passwords alone) is highly vulnerable: users reuse passwords, choose weak combinations, or fall victim to phishing and credential database breaches.

Two-Factor Authentication (2FA) requires the user to provide two independent authentication factors from different categories before access is granted:

Why 2FA is Superior:

• If a cybercriminal steals a user's password via a phishing email or brute-force attack, the password alone is insufficient, but other attacks can still compromise the account.
• Access is denied because the attacker does not physically possess the user's mobile device or hardware security token needed to generate the dynamic, time-sensitive one-time verification code.

Match each defence to a risk

Access levels restrict users to the data/actions required for their role, reducing unauthorised changes or disclosure. Strong unique passwords and two-step verification reduce the risk from a stolen password alone; codes and recovery routes can still be attacked. Automatic updates apply security fixes against known vulnerabilities. Anti-malware scans/quarantines suspicious software, but signatures and software must stay current. Privacy settings limit sharing/tracking; they are not a substitute for patching.

A firewall applies rules to traffic, such as protocol, address and port. In the exercise below assume packets are TCP and apply rules in order, first match wins. A firewall does not decide whether every permitted document or message is honest.

Independent application

A receptionist needs contact details but should not edit payroll. Choose a defence and explain why it addresses the requirement. Then choose a different defence for a known flaw in the operating system, and explain why the first defence is insufficient.

Written practice and self-review

Modern cybersecurity frameworks implement layered defences to protect organizational networks.

1. Describe how a Proxy Server functions as an intermediary between local client computers and external web servers, identifying two distinct benefits it provides (e.g. IP masking, web caching, or content filtering).
2. Explain why Two-Factor Authentication (2FA) provides vastly superior protection against account takeovers compared to passwords alone.

Write an explanation before checking the theory. Check that each claim answers the question, uses the correct concept and explains why it applies. Discuss uncertain points with a teacher. The structured exercise below checks specific facts; it does not automatically mark this explanation.