Network Security
Why Network Security Matters
Every connected device is a potential target. A school network holds thousands of student and staff records. A hospital network carries patient data. A retail network processes payment details. network security is the combination of measures that protect these systems. A single unguarded entry point can expose an entire organisation’s data — which is why securing networks requires both identifying vulnerabilities before attackers do, and putting protections in place to prevent or limit damage if an attack occurs.
Network security thinking divides into two clear stages: identification (finding weaknesses) and protection (preventing or containing attacks). Both are equally important. A network that is well protected but never tested for new vulnerabilities will eventually be exploited through an overlooked weakness.
Identifying Vulnerabilities: Penetration Testing
penetration testing (often called “pen testing”) is the practice of deliberately attempting to break into a network or system — with the organisation’s knowledge and permission — to find security weaknesses. The goal is to discover vulnerabilities before a genuine attacker does, so they can be fixed. Penetration testers produce a detailed report of every weakness found, how it was exploited, and how to remediate it.
Penetration tests can target network infrastructure (routers, switches, firewalls), individual devices on the network, or the software running on those devices. A thorough pen test may include trying to intercept unencrypted network traffic, testing whether wireless access points accept weak passwords, or attempting to connect unauthorised devices to the network.
Penetration testing is only legal and ethical if the organisation explicitly authorises it in writing. The same techniques used in a pen test — scanning for open ports, attempting to bypass authentication, intercepting traffic — would be crimes under the Computer Misuse Act 1990 if carried out without permission. The authorisation is what transforms the activity from criminal hacking to a legitimate security service.
Identifying Vulnerabilities: Ethical Hacking
ethical hacking is the broader discipline of which penetration testing is one technique. An ethical hacker (sometimes called a white-hat hacker) has the same knowledge and tools as a malicious attacker but operates within a legal and ethical framework agreed with the client. Ethical hacking may also include social engineering tests (e.g. attempting to trick staff into revealing passwords), physical security tests (e.g. trying to enter a server room without authorisation), and code review to find software vulnerabilities.
The value of ethical hacking is in perspective: an external expert approaching a system with fresh eyes, using attacker techniques, will find vulnerabilities that internal IT staff who designed the system might overlook. Many organisations engage ethical hackers before launching a new network, after a significant change, or on a regular schedule.
A school contracts a security firm to conduct a penetration test of its network before the start of term. The testers are given written authorisation from the headteacher. Over three days, they:
- Scan all network devices for open ports and identify three devices running outdated software with known security flaws.
- Attempt to connect a laptop to the school Wi-Fi using default router credentials — and succeed, because the admin password had never been changed.
- Attempt to access the server room by following a member of staff through the door — this “tailgating” attempt succeeds because the door was propped open.
Their report details all three vulnerabilities with recommendations: update the outdated software, change the router’s admin credentials, and enforce a strict door-closing policy. The school fixes all three before term begins. Without the pen test, any of these vulnerabilities could have been exploited by a malicious attacker.
Protecting Networks: Access Control
access control is the first line of protection: ensuring that only authorised users and devices can connect to the network, and that each user can only access the resources appropriate to their role. In a school, a student account might have access to shared homework folders but not to the administration system. A teacher account has broader access. A network administrator has the highest level of access.
Access control is implemented through user accounts and passwords, combined with user permissions that define what each account can do. Strong access control requires regularly reviewing who has which permissions, disabling accounts when users leave the organisation, and ensuring that users do not share accounts or passwords.
Protecting Networks: Physical Security
physical security protects the hardware that a network runs on. No amount of software-based security matters if an attacker can walk into a server room and physically remove a hard drive. Physical security measures include:
- Locked server rooms — restricting entry to authorised personnel only, often using key cards, PIN pads or biometric readers on doors.
- Cable management — securing network cables so they cannot be easily unplugged or tampered with.
- Locked equipment — physically securing network switches and routers so they cannot be removed or reset.
- CCTV and visitor logs — monitoring who enters secure areas and maintaining a record that can be reviewed after a security incident.
Protecting Networks: Firewalls
A firewall acts as a gatekeeper between a trusted internal network and an untrusted external one — typically the internet. It examines each data packet and decides, based on rules set by the network administrator, whether to allow it through or block it. A school might configure its firewall to block traffic to certain categories of website, reject all incoming connections on ports not used by school systems, and alert the administrator when unusual patterns of traffic are detected.
Packet filtering is the most common firewall technique: the firewall inspects the header of each packet (looking at source IP address, destination IP address, port number and protocol) and either allows or blocks it based on the rules. A packet from an unknown external IP address trying to connect to an internal database server on a port that should not be publicly accessible will be blocked. A packet from a trusted address connecting on an expected port will be allowed through.
Three categories of network protection: Access control — user accounts, passwords and permissions ensure only authorised users can connect and limit what they can do. Physical security — locked server rooms, secured cabling and equipment prevent physical tampering. Firewalls — inspect and filter packets based on rules, blocking unauthorised traffic between the internal network and external networks such as the internet.
Identification and protection are complementary, not alternatives. Access control, physical security and firewalls reduce the chance of a successful attack. But no defence is perfect: new vulnerabilities appear constantly as software changes, new devices are added and human behaviour varies. Penetration testing and ethical hacking identify weaknesses that protections have missed or that have developed since protections were last reviewed. A mature security strategy uses both: robust protections, tested regularly by independent experts who try to break them.
Example: a firewall may block most unauthorised traffic, but a pen test might discover that a misconfigured rule allows traffic through on an unexpected port. Without the pen test, this misconfiguration might go unnoticed until a malicious attacker finds it first.