Network security measures are the combination of technical and physical controls used to protect a network and its data from unauthorised access, theft, and disruption. No single measure is sufficient on its own; effective security requires a layered approach where multiple controls work together. GCSE Computer Science requires students to name, describe, and evaluate these measures.
What is access control and why is it fundamental?
Access control determines who can see, use, or modify resources on a network. Without it, any user could access any file, database, or system — an obvious risk in a school, hospital, or business.
The two key components are:
- Authentication — verifying that a user is who they claim to be (username + password, 2FA, biometrics).
- Authorisation — once authenticated, determining which resources that user may access. A student can read their own files but not a teacher's markbook; a teacher can read pupil records but not the headteacher's HR data.
The principle of least privilege states that users should be granted only the minimum permissions needed to do their job. This limits the damage if an account is compromised: a hacked student account cannot access payroll data it was never authorised to see.
How do firewalls protect a network?
A firewall monitors incoming and outgoing network traffic and blocks packets that do not meet defined rules. It acts as a gatekeeper between a trusted internal network and an untrusted external one (typically the internet).
Firewall rules specify:
- Allowed and blocked IP address ranges
- Permitted port numbers (e.g. allow port 443 for HTTPS, block port 23 for unencrypted Telnet)
- Permitted protocols (e.g. allow TCP, block UDP on certain ports)
A stateful firewall also tracks active connections and only allows inbound traffic that is part of an established session — stopping unsolicited inbound connection attempts.
How does encryption protect data in transit?
When data travels across a network, it may pass through many routers and switches operated by different organisations. Encryption in transit ensures that even if packets are intercepted, their contents are unreadable.
| Protocol | What it protects | How |
|---|---|---|
| TLS (HTTPS) | Web browsing | Encrypts the entire HTTP exchange; server authenticated by certificate |
| WPA2 / WPA3 | Wi-Fi traffic | Encrypts data between device and wireless access point |
| SSH | Remote server access | Replaces unencrypted Telnet; all commands encrypted |
| VPN | All traffic from a device | Wraps traffic in an encrypted tunnel to a VPN server |
Encryption alone does not prevent a denial-of-service attack (the attacker does not need to read the packets to flood the server), but it prevents data theft from eavesdropping.
What are user accounts and access levels?
Most networks implement user accounts managed by a directory service (such as Active Directory in Windows environments). Each account belongs to one or more groups, and permissions are assigned to groups rather than individuals, making administration manageable.
Typical access levels in a school network:
| Account type | Permissions |
|---|---|
| Student | Read/write own files; read shared lesson resources |
| Teacher | Read/write own files; read/write class resources; view pupil records |
| Network administrator | Full access to all systems; can create and delete accounts |
| Guest | Very limited — often read-only on selected public resources only |
Restricting access reduces both accidental damage (a student cannot delete a teacher's files) and malicious damage (a compromised student account limits what an attacker can reach).
What physical security measures protect a network?
Technical controls protect networks from remote attacks, but physical security protects against someone physically tampering with or stealing hardware.
| Measure | Purpose |
|---|---|
| Locked server rooms | Only authorised engineers can access routers, switches, and servers |
| Cable locks | Laptops and desktop computers are anchored to desks |
| CCTV | Deters theft; provides evidence if equipment is stolen |
| Visitor sign-in and ID badges | Controls who enters the building and which areas |
| Device encryption | If a laptop is stolen, the data on it cannot be read without the decryption key |
Physical and technical controls are complementary: the most sophisticated software firewall provides no protection if an attacker can walk into the server room and connect a rogue device to the network.
Frequently asked questions
What is the difference between a firewall and antivirus software?
A firewall controls network traffic — it decides which connections are allowed in and out based on rules. Antivirus software scans files and processes on a device for known malicious code. A firewall stops a threat from entering the network; antivirus detects threats that are already on the device. Both are needed: a firewall cannot catch malware delivered on a USB stick, and antivirus cannot block a network intrusion. Most modern endpoint security suites combine both.
Why is strong password policy part of network security?
Passwords are the most common form of authentication. Weak passwords make brute-force attacks fast: a six-character all-lowercase password has only 26⁶ ≈ 309 million combinations — crackable in minutes with modern hardware. A 12-character password mixing upper, lower, digits, and symbols expands the search space enormously. Network administrators enforce password policies through group policy settings: minimum length, complexity requirements, expiry periods, and prevention of reuse. Without this, users default to weak, reused passwords regardless of instructions.
What is the difference between a white-list and a black-list firewall approach?
A blocklist (blacklist) approach allows all traffic except that which matches a list of known bad addresses or patterns. It is easier to maintain but allows unknown threats through. An allowlist (whitelist) approach blocks all traffic except that which matches a list of explicitly approved addresses and ports. It is stricter and more secure but requires careful maintenance to avoid blocking legitimate traffic. For high-security environments, the allowlist approach is preferred.
How does network monitoring help detect security breaches?
Network monitoring tools record traffic patterns and generate alerts when anomalies occur — for example, a spike in outbound traffic at 3 a.m., a device connecting to a known malicious IP address, or repeated failed login attempts (indicating a brute-force attack in progress). Monitoring turns the network into a detective system. Without it, a breach can go undetected for months. Alongside preventative measures, monitoring forms part of a complete security posture that includes detection and response.
Professor Turing helps you revise every GCSE network security measure — with exam-focused answers and Socratic questioning — at aitutors.me.