Computer Science · Security Unit · Session 5 of 8
No single control stops everything. That's not a flaw — it's the whole design principle.
A firewall doesn't know if a login page is fake. Anti-malware doesn't catch everything. A lock doesn't stop someone borrowing the laptop they're authorised to carry. None of that means any of them are pointless — it means security works in layers, each one covering what the last one misses. This session is about building that stack, and about the attack that doesn't try to get in at all: denial of service.
Executive summary
Goal: match controls to threats, and explain why any one protection, alone, is insufficient.
| Task | Minutes |
|---|---|
| Recall encryption and backup differences | 5 |
| Read notes and diagram | 15 |
| Core video and question | 10 |
| Network decisions and scenarios | 20 |
| Check and exit question | 10 |
1. What a firewall does
Networked devices exchange data in packets. A firewall permits or blocks traffic according to configured rules. Depending on its capabilities, it may inspect source and destination addresses, ports, connection state or application information. A port helps identify a network service — you don't need to memorise port numbers for this course.
A firewall can sit on an individual device or between whole networks, and it can control traffic in either direction. Rules matter enormously: a badly configured firewall can just as easily permit unwanted access as block legitimate work.
2. Separating networks
Network segmentation places devices into groups and restricts communication between them. The club's guest Wi-Fi shouldn't hand visitors unrestricted access to administration systems just because they're on the same premises. Segmentation reduces how far an attacker can travel after compromising one single device.
Reading the diagram: guest access and school access run under different rules entirely. Being on the school network still doesn't grant permission to read every record — the dotted branch is a blocked route, not an allowed connection that just happens to be unused.
3. Complementary controls
| Control | How it helps | Limitation |
|---|---|---|
| Security updates | Repair known software weaknesses | Do not fix every unknown flaw or prevent all social engineering |
| Anti-malware | Detects known malicious patterns or suspicious behaviour | Can miss threats or produce false alarms |
| Restricted installation | Limits what users can install or run | Requires management and may delay legitimate work |
| Segmentation | Restricts movement between device groups | Depends on correct rules and does not fix an already-compromised device |
| Physical locks | Reduce unauthorised physical access | Can be bypassed; do not protect a device an authorised user takes home |
| Staff/student education | Helps people recognise and report risky requests | People still make mistakes |
| Logging and monitoring | Help identify suspicious events and support investigation | Need review and response; recording alone does not block harm |
Defence in depth combines controls so one failure doesn't automatically cascade into the worst outcome. Combining independent protections is far more useful than repeating the same weak control twice.
4. Denial of service
A denial-of-service attack aims to make a service unavailable — for example, by exhausting its capacity. A distributed denial-of-service attack does this using many sources at once. It doesn't need to steal a single piece of information to still be damaging. Filtering, provider support and resilient service design can all help, but a single school firewall can't be assumed to absorb unlimited incoming traffic on its own.
Watch
Activities
Reveal model answers and check your work
The guest administration request is blocked; guest public browsing is allowed; the school application connection is allowed. Application authentication and authorisation must still decide whether editing is actually permitted — reaching the application is not the same as being allowed to change it.
Suitable pairs include restricted installation with anti-malware; segmentation with kept-updated school devices; and locked storage with disk encryption. Be specific about what each half does: disk encryption limits exposure after theft, while locked storage reduces the likelihood of theft happening at all.
Key terms
- packet
- firewall
- rule
- segmentation
- defence in depth
- security update
- monitoring
- denial of service
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8