Network Security in Computer Networks
In the previous chapter, we looked at IP Addressing and how every device on a network is uniquely identified so that data can actually find its way to the correct destination. But simply being able to reach a device isn't enough on its own — that same addressing system that allows legitimate communication to happen can just as easily be used by someone with harmful intent to intercept, alter, or disrupt that communication. Network Security is the final chapter in this Computer Network series, and it covers the concepts and techniques used to protect data and devices from exactly this kind of unauthorised access and interference.
Every layer of a network we've discussed so far, from the physical cables and devices to the addressing and protocols that move data between them, can potentially be targeted or exploited if left unprotected. Network Security brings all of these earlier topics together under one central question: how do we make sure that only the intended sender and receiver can meaningfully access and trust the data being exchanged between them?
Security Services
Before looking at specific techniques, it helps to understand the underlying goals that network security is actually trying to achieve. These goals are commonly described as a set of security services, each addressing a different aspect of what it means for communication over a network to be genuinely secure.
Confidentiality ensures that information travelling across a network is not accessible to anyone other than its intended, authorised recipient, preventing outsiders from being able to read or make sense of data that isn't meant for them.
Authentication ensures that the identity of a sender or a receiver can be reliably verified, so that both parties in a communication can be confident they are actually talking to who they believe they are talking to, rather than an impersonator.
Integrity ensures that only an authorised party is able to change or modify data, so that a receiver can trust that the information they've received hasn't been secretly altered by someone else along the way.
Non-Repudiation ensures that once data has been sent or received, neither party involved can later falsely deny having taken part in that exchange, which is particularly important for communications that carry some form of legal or contractual weight.
Access Control ensures that data can only be accessed by the specific devices or users it is actually intended for, restricting the ability of unauthorised parties to reach resources they shouldn't be able to.
Availability ensures that data and network resources remain accessible to authorised parties whenever they are legitimately needed, protecting against situations where a network or service is deliberately made unusable.
Privacy is concerned more broadly with keeping the network and the information flowing across it secure, protecting not just the content of communications but also details about who is communicating with whom.
Cryptography
Cryptography is the core technique that underlies most of the security services described above, particularly confidentiality and integrity. It works by transforming readable data, known as plaintext, into a scrambled, unreadable form, known as ciphertext, using a mathematical process guided by a key. Only someone who possesses the correct key can reverse this process and recover the original readable data. As shown in the diagram, cryptography is broadly divided into two categories, based on how the keys used for this process are actually managed: Symmetric Key Cryptography and Asymmetric Key Cryptography.
Symmetric Key Cryptography
In Symmetric Key Cryptography, the exact same secret key is used for both encryption and decryption. As shown in the diagram, the sender uses this shared secret key to convert the original plaintext into ciphertext through an encryption process, and once that ciphertext reaches the receiver, the very same secret key is used again, this time to reverse the process through decryption, converting the ciphertext back into the original plaintext.
Because encryption and decryption both rely on identical keys, this approach requires the sender and receiver to have already securely agreed on and shared that one secret key before any protected communication can actually begin. Symmetric Key Cryptography is generally fast and computationally efficient, making it well suited to encrypting large volumes of data, but it introduces a practical challenge: safely distributing that shared secret key to both parties in the first place, especially over a network that might itself be insecure.
Asymmetric Key Cryptography
Asymmetric Key Cryptography solves the key-sharing problem of Symmetric Key Cryptography by using two separate, mathematically related keys instead of one shared key: a public key and a private key. As shown in the diagram, the client uses one of these keys to encrypt plaintext into ciphertext, while the server at the other end uses the other, different key to decrypt that ciphertext back into the original plaintext. Whichever key is used to encrypt the data, only its mathematically paired counterpart is capable of decrypting it again.
The public key, as its name suggests, can be shared openly with anyone, since it can only be used to encrypt data, not decrypt it. The private key, on the other hand, is kept strictly secret by whoever it belongs to, and is the only key capable of decrypting data that was encrypted using its matching public key. This design completely removes the need to secretly share a key in advance, since anyone can safely use a widely published public key to send encrypted data that only the intended, private-key-holding recipient can actually decrypt. The trade-off is that Asymmetric Key Cryptography is generally more computationally demanding than Symmetric Key Cryptography, which is why it is often used to securely exchange a symmetric key at the start of a connection, after which the faster symmetric approach takes over for the bulk of the actual data transfer.
Firewalls
A firewall is a network security device or piece of software that monitors incoming and outgoing traffic on a network and decides whether to allow or block that traffic based on a defined set of security rules. Positioned at the boundary between a trusted internal network and an untrusted external network, such as the internet, a firewall acts as a checkpoint, examining each piece of traffic attempting to cross that boundary and comparing it against its configured rules before deciding whether to permit it through or reject it outright.
Firewalls can filter traffic based on a variety of criteria, such as the source or destination address of the data, the specific port a connection is attempting to use, or the type of protocol involved. By blocking traffic that doesn't match legitimate, expected patterns, a firewall significantly reduces a network's exposure to unauthorised access attempts and many common categories of network attacks, acting as one of the most fundamental and widely deployed layers of protection in both home and enterprise networks.
Common Network Threats
Understanding the kinds of threats a network actually faces makes it easier to appreciate why techniques like cryptography and firewalls are so important. Malware refers to malicious software, such as viruses or spyware, designed to damage a system or secretly steal information once it manages to infiltrate a device. Phishing involves tricking a person into revealing sensitive information, such as login credentials, often by impersonating a trustworthy source through a fake message or website.
A Denial-of-Service (DoS) attack attempts to overwhelm a network or server with an excessive volume of traffic or requests, aiming to exhaust its resources so that legitimate users are no longer able to access it, directly undermining the availability service described earlier. A Man-in-the-Middle attack involves an attacker secretly intercepting and potentially altering communication between two parties who believe they are communicating directly and privately with each other, undermining both confidentiality and integrity.
Basic Protection Techniques
Beyond cryptography and firewalls, a number of additional practices further strengthen a network's overall security. Keeping software and devices regularly updated helps close known vulnerabilities before they can be exploited by attackers. Strong, unique authentication credentials, ideally combined with an additional verification step, make it significantly harder for an unauthorised party to successfully impersonate a legitimate user. Regularly monitoring network activity for unusual patterns can also help identify a potential attack early, before it has the chance to cause significant damage, connecting directly back to the ongoing vigilance emphasised by the availability and access control services described earlier in this chapter.
Comparison of Symmetric and Asymmetric Key Cryptography
| Aspect | Symmetric Key Cryptography | Asymmetric Key Cryptography |
|---|---|---|
| Keys Used | One shared secret key for both encryption and decryption | Two separate keys — a public key and a private key |
| Key Sharing | The secret key must be securely shared in advance | The public key can be shared openly; the private key stays secret |
| Speed | Generally faster and less computationally demanding | Generally slower and more computationally demanding |
| Typical Use | Encrypting large volumes of actual data | Securely exchanging a symmetric key or verifying identity |
Best Practices While Learning Network Security
- Learn the seven security services first, since they describe the goals every other technique in this chapter is ultimately trying to achieve.
- Remember Symmetric Key Cryptography by its single shared key, and Asymmetric Key Cryptography by its two mathematically paired keys.
- Connect Asymmetric Key Cryptography's public/private key pair directly to how it solves the key-distribution problem faced by Symmetric Key Cryptography.
- Think of a firewall as a checkpoint at the network boundary, filtering traffic rather than encrypting it.
- Relate each common threat back to the specific security service it undermines, such as a DoS attack targeting availability, or a Man-in-the-Middle attack targeting confidentiality and integrity.
Common Mistakes Beginners Make
| Mistake | Correct Practice |
|---|---|
| Assuming Symmetric and Asymmetric Key Cryptography use the same number of keys. | Symmetric uses one shared key, while Asymmetric uses a mathematically related public and private key pair. |
| Thinking a firewall encrypts data passing through it. | A firewall filters and controls traffic based on rules; encryption is a separate function handled by cryptography. |
| Confusing Confidentiality with Integrity. | Confidentiality prevents unauthorised access to data, while Integrity prevents unauthorised modification of that data. |
| Believing Asymmetric Key Cryptography is always the better choice because it's more secure. | Asymmetric Key Cryptography is more computationally demanding, so it's often combined with the faster Symmetric approach rather than used alone. |
Frequently Asked Interview Questions
-
What is the main difference between Symmetric and Asymmetric Key Cryptography?
Symmetric Key Cryptography uses one shared secret key for both encryption and decryption, while Asymmetric Key Cryptography uses two separate, mathematically related keys — a public key and a private key. -
Why is key distribution a challenge in Symmetric Key Cryptography?
Because both the sender and receiver need to already possess the exact same secret key before secure communication can begin, and safely sharing that key over an insecure network is difficult. -
How does Asymmetric Key Cryptography solve the key-sharing problem?
By allowing the public key to be shared openly, since it can only be used to encrypt data, while the private key needed to decrypt that data is kept secret and never needs to be shared. -
What is the purpose of a firewall?
A firewall monitors traffic crossing the boundary of a network and allows or blocks it based on a defined set of security rules, helping prevent unauthorised access. -
What is the difference between Confidentiality and Authentication as security services?
Confidentiality ensures that only authorised parties can access the content of data, while Authentication ensures that the identity of the sender or receiver can be reliably verified. -
What does a Denial-of-Service attack target?
A Denial-of-Service attack targets the availability of a network or service by overwhelming it with excessive traffic, preventing legitimate users from accessing it. -
Why is Symmetric Key Cryptography often still used alongside Asymmetric Key Cryptography?
Because Symmetric Key Cryptography is faster and better suited to encrypting large amounts of data, so it's often used for the actual data transfer after Asymmetric Key Cryptography has been used to securely exchange that symmetric key.
Summary
Network Security brings together everything else covered in this series under one central goal: making sure the devices, protocols, and data discussed throughout this Computer Network series can actually be trusted and protected. We looked at the seven core security services that define what secure communication really means, the two major branches of cryptography — Symmetric and Asymmetric Key Cryptography — along with firewalls, common network threats, and basic protection techniques used to guard against them.
This chapter completes the Computer Network series covered on this site, bringing together everything from network basics, topologies, and transmission media through the OSI and TCP/IP models, multiplexing, switching, error detection, network devices and protocols, IP addressing, and finally network security — the full set of concepts that together explain how modern computer networks actually work.