IB Computer Science Topic A2.4: Network Security Key Definitions

The application layer provides the interface between applications and the network.

Asymmetric cryptography gives each party a mathematically linked key pair: a public key that can be published to anyone and a private key that never leaves its owner. It solves key distribution but is far slower than symmetric cryptography.

A header a server sends to the browser that lists which sources the page is allowed to load code from, which is what blocks cross-site scripting (XSS).

Cross-site scripting (XSS) is an attack in which a script is placed into content a website stores and serves, so it runs in the browser of every other user who views that content.

Deep packet inspection (DPI) is filtering that reads the data a packet carries as well as its header, so a firewall can act on the contents of a request rather than only on its addresses, ports and protocol.

A digital certificate is an electronic document that binds a public key to the identity of its owner. A certificate authority verifies that identity and signs the certificate, so a client can check the binding before trusting the key.

Distributed denial of service (DDoS) is an attack that makes a service unavailable by flooding it with traffic from many compromised devices at once, so legitimate requests cannot be served.

Encryption converts readable plaintext into unreadable ciphertext using an algorithm and a key. The process is reversible: the right key turns the ciphertext back into the original plaintext.

Firewalls are security devices that monitor and control network traffic based on predetermined rules. They act as a barrier between trusted and untrusted networks.

Malware is software written to damage a system, disrupt its operation, or gain unauthorised access to it, including ransomware, spyware, rootkits, trojans, worms and keyloggers.

Man-in-the-middle (MitM) attack is an attack in which traffic between two parties passes through the attacker, who can read it and alter it while both ends believe they are communicating directly.

Network address translation (NAT) is the process by which a router rewrites the private source address of an outgoing packet to its own public address, records the swap with a port number, and reverses the rewrite on the reply. It lets many private devices share one public IP address.

Phishing is an attack that imitates a trusted sender in a message so the reader hands over credentials or sensitive information, exploiting the person rather than a software flaw.

A session key is a symmetric key agreed at the start of one connection, used to encrypt that connection's data, and discarded when the connection ends.

SQL injection is an attack in which text entered into an input field is read by the database as part of the query, letting the attacker read, change or delete data on the server.

Symmetric cryptography uses a single shared key to both encrypt and decrypt data. It is fast enough to protect the bulk of the traffic in a connection, but both parties must already hold the same secret key.

A VPN extends a private network across a public network, such as the internet.

Zero-day exploit is an attack on a vulnerability the vendor does not yet know about, so no patch and no detection signature for it exists when the attack is used.