Firewalls, anti-malware and encryption: guarding the system

A stand-alone PC is one machine with no network connection. Its protection comes from the machine itself: a login account, a screen lock, anti-virus software, a disk encrypted with a password, and a physical lock on the case.

A network of computers has all of those, plus more ways in:

• traffic arrives from outside, so a firewall is needed at the boundary;
• many users share files and servers, so user accounts and access rights matter far more;
• a virus on one machine can travel to the others, so anti-malware must be on every machine and kept updated;
• data crosses cables and Wi-Fi, so encryption of network traffic (for example HTTPS or a VPN) is needed.

The measures are the same kinds of thing. What changes is how many places they have to cover.

A rule list is read from the top down, and the first match wins. A very small example:

Notice two things.

• The firewall does not judge whether the traffic is good — only whether the rule allows it.
• It filters both directions: blocking a suspicious outbound connection can stop an infected machine "phoning home".

What a firewall cannot do:

• It cannot stop an authorised user misusing their access.
• It cannot stop malware arriving on a USB stick or in a file the user chooses to download.
• It cannot tell that a legitimate-looking web request is really spyware sending data out, unless a rule blocks that destination.
• By itself it does not scan file contents for viruses.

Encryption converts readable data (plaintext) into scrambled data (ciphertext) using a key. Without the key, the ciphertext is meaningless.

On a single machine it is used in three common places:

• Full-disk encryption — the whole drive is unreadable until the correct password unlocks it, so removing the disk from a stolen laptop gains nothing.
• Encrypted backups — a backup tape or cloud backup is only as safe as its encryption, because it leaves the building.
• Encrypted network traffic — HTTPS on websites, and a VPN between an office and a remote worker, so data cannot be read if it is intercepted on the way.

What encryption does not do: it does not stop malware running on the machine, it does not stop an authorised user copying files they can already open, and it does not detect a corrupted file. The next lessons cover these gaps.