← Understanding a computer science concept

Computer security and firewalls, in depth

Not offered as its own topic in the 2025 task, but the underlying concepts (firewalls, malware, updates) remain examinable within AI/encryption "problems and issues" parts, and could return as a topic in a future year.

The two layers of firewall protection, and why both matter

• NETWORK FIREWALL: sits at the boundary between the internal network and the internet, inspecting and filtering traffic BEFORE it reaches any individual device — stops external attacks from reaching machines at all.
• HOST (INDIVIDUAL COMPUTER) FIREWALL: runs on each individual machine, limiting what an ALREADY-INFECTED device can reach — if malware gets past the network firewall (e.g. via a USB drive or phishing email opened locally), the host firewall still limits its ability to spread or communicate outward.
• An organisation needs BOTH because they defend against different attack paths — a network firewall alone cannot stop an infection that entered by a route other than the network (an infected USB stick, a compromised employee laptop brought from home).

Worked example Explaining why an organisation needs firewalls at both the network AND individual-computer level Discuss why organisations need firewalls at both the internet entry point and on individual computers. NETWORK FIREWALL ROLE: filters all traffic entering/leaving the organisation's internet connection, blocking known-malicious addresses, ports, and traffic patterns before they reach any device. GAP IT LEAVES: it cannot see or control threats that never cross the internet boundary — an infected USB drive plugged directly into a computer, or malware already present on a laptop brought in from home. HOST FIREWALL ROLE: fills this gap by controlling what each individual machine can send and receive, limiting an already-present infection's ability to spread to other machines on the network or communicate with an external attacker. CONCLUSION: the two layers defend against DIFFERENT entry points — network-based attacks and locally-introduced ones — so relying on only one leaves a genuine gap. ✓ Naming the SPECIFIC gap each layer leaves, and how the other layer fills it, is what separates a full answer from simply listing "firewalls are good security". ✕

Treating a firewall as blocking all threats equally

A firewall filters based on RULES (ports, protocols, addresses, application signatures) — it does not detect or stop every kind of threat. Malware delivered via a legitimate-looking email attachment, or an already-authorised connection being misused, can bypass firewall rules entirely; other controls (antivirus, user training, updates) are needed alongside it.

Layer	What it stops	What it misses
Network firewall	External traffic-based attacks	Locally-introduced infections (USB, brought-in device)
Host firewall	Spread from an already-infected device	The initial infection itself

Practice for this standard covers the whole topic — flashcards and quiz.