1.3.3(c)Networks and SecurityCore

Proxies, Network Threats and Layered Defence

A threat explanation should connect a mechanism, a possible consequence and an appropriate control. A single security product cannot remove every path by which a system might be compromised.

35 min Network Defence

What you'll be able to do

Explain proxy and firewall responsibilities
Distinguish phishing, pharming, malware, denial of service and injection
Select controls with explicit limitations

Place intermediary controls correctly

A proxy acts as an intermediary for requests. A forward proxy can mediate clients’ access, apply policies, log requests or cache permitted responses. A reverse proxy stands in front of servers and can route incoming requests or provide other gateway functions. Caching must respect whether a response is private or unsuitable to reuse.

A firewall allows or blocks traffic according to configured rules and capabilities. It can restrict exposed services or communication paths, but permitted traffic can still carry malicious content or requests. Encryption protects relevant traffic against observation or modification when properly designed and authenticated; it does not make the receiving program’s logic automatically safe.

Distinguish human and technical paths

Phishing uses deceptive communication to induce an action such as revealing credentials. Pharming redirects a user towards a fraudulent service, for example through compromised name-resolution or local configuration. Similar-looking outcomes do not make the mechanisms identical. Independently checking the destination and using stronger authentication can reduce risk, but training alone does not fix every technical weakness.

Malware includes viruses that infect suitable host material and spyware that gathers information. A denial-of-service attack aims to exhaust a resource or otherwise prevent legitimate access; a distributed attack uses multiple sources. Security updates, access controls, monitoring and filtering reduce particular opportunities, but their effectiveness depends on deployment and the threat.

Keep data separate from commands

SQL injection occurs when untrusted input is interpreted as part of a query’s structure. A parameterised query keeps a supplied value in a data position instead of building executable SQL by concatenation. Validation still checks application rules, while least-privilege database access limits what a compromised component can do. These controls have different responsibilities.

Combine measures around the scenario: authorisation on the server, appropriate password verification, backups and recovery, patching, monitoring and staff procedures. Explain residual risk rather than claiming that a firewall “stops hackers” without detail. An authorised user can also misuse legitimate access; permissions, audit and organisational practice therefore matter alongside network filtering.

Python 3

import sqlite3
db = sqlite3.connect(":memory:")
db.execute("CREATE TABLE Member (Name TEXT)")
db.execute("INSERT INTO Member VALUES (?)", ("Amina",))
supplied_name = "O'Brien"
rows = db.execute(
    "SELECT Name FROM Member WHERE Name = ?",
    (supplied_name,)
).fetchall()
print(rows)
db.close()

Scroll horizontally to see the full code or table.

The placeholder binds the whole name as data, including its apostrophe. This disposable database contains no matching member.

Work through the problem

Attempt the task before opening its worked response. Record each change of state, explain the rule used, and check the result against the original requirements. Code examples labelled Python 3 use that language’s conventions; pseudocode states its own assumptions.

Example 1Why does blocking all but the web server port not prevent every SQL injection fault?

1Legitimate web traffic is still permitted.

2The application behind that port may incorrectly construct database commands from supplied data.

AnswerNetwork filtering and safe query construction address different layers.

Example 2Compare phishing and pharming in a login scenario.

1Phishing might send a deceptive message asking the user to follow a false login link.

2Pharming might redirect an otherwise intended destination through compromised resolution or configuration.

AnswerExplain the redirection or deception mechanism, then choose relevant controls.

Common mistakes to avoid

Offering one control without explaining the threat mechanism.

Connect the attack path to the control and its limits.

Treating validation as a substitute for parameter binding.

Apply application rules and safe command construction together.

Key takeaways

Proxies and firewalls mediate different aspects of communication.
Threat mechanisms determine appropriate controls.
Layered defence includes application and organisational measures.

Test yourself

Answer a few questions, then review anything you missed.

Next step

Keep practising

Start with the quiz above to check the key ideas. You can also choose another topic from the practice library.

Browse practice topics

import sqlite3 db = sqlite3.connect(":memory:") db.execute("CREATE TABLE Member (Name TEXT)") db.execute("INSERT INTO Member VALUES (?)", ("Amina",)) supplied_name = "O'Brien" rows = db.execute( "SELECT Name FROM Member WHERE Name = ?", (supplied_name,) ).fetchall() print(rows) db.close()