ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control Hangman

The 143 key terms

1network

A group of digital systems connected together so they can share data, files, printers and an internet connection. Each connected device is called a node.

2internet

The global network of networks that connects computers worldwide. The World Wide Web is one service that runs on it, alongside email, streaming and online games.

3client-server

A client, like your browser, sends a request for data and a server stores that data and sends a response back.

4LAN vs WAN

A LAN connects devices in one small area like a home or school. A WAN connects many LANs over a large distance. The internet is the largest WAN.

5network interface

The internal part of a device that lets it send and receive data on a network, using an Ethernet port for wired links or a wireless adapter for Wi-Fi.

6network switch

A device that connects computers on the same network and sends data only to the device it is meant for, using its ports. A router links different networks.

7router

A device that directs data between networks, such as joining a home LAN to the internet and choosing the path data packets take. A home Wi-Fi router also shares the connection wirelessly.

8wireless access point

A device that connects to a wired network and broadcasts a Wi-Fi signal so wireless devices can join the network.

9modem

A device that converts signals so a local network can connect to an internet service provider (ISP), such as over an NBN connection. A router then shares that connection.

10operating system

The software that manages a device's hardware and runs other software, like Windows, macOS, ChromeOS, Android or iOS. It handles files and memory and gives you the user interface.

11device driver

Software that lets the operating system talk to a piece of hardware, such as a printer, so the device works properly.

12star topology

A network layout where each device has its own cable to a central switch or router, so one broken cable cuts off only that device. If the central device fails, the whole network goes down.

13network diagram

A drawing that shows each device as a labelled symbol and each connection as a line, so you can see how data can travel between devices.

14MAC address

A unique hardware address given to one network interface card (NIC). Each NIC has its own, so a device with Wi-Fi and Ethernet has two. It identifies the hardware, not the network.

1500:1A:2B:3C:4D:5E

A MAC address is six pairs of hex digits (two digits per pair, 48 bits in total), separated by colons or hyphens, such as 00:1A:2B:3C:4D:5E.

16IP address

A unique number that identifies a device on a network, like a postal address, so data knows where to go. IPv4 looks like 192.168.1.5.

17IPv4 address

32 bits written as four denary numbers from 0 to 255 separated by full stops, such as 190.0.5.20. Each number is a group of 8 bits.

18invalid IPv4 address

An address without exactly four groups, or with a group outside 0 to 255. Examples: 256.1.1.1 (too big), 192.168.1 (too few groups), 10.-5.2.1 (negative) and 10.a.2.1 (letter).

19IPv6 address

A 128-bit address written as eight groups of four hex digits separated by colons, e.g. 2001:0DB8:0000:0000:0000:FF00:0042:8329

20static IP address

An IP address that is set once, usually by hand, and stays the same every time the device connects, so the device always has a predictable address.

21dynamic IP address

An IP address given to a device automatically by the network each time it connects, so it may change and can later be reused by another device.

22DHCP

Dynamic Host Configuration Protocol: a router service that automatically gives each joining device an IP address, subnet mask and default gateway, so no manual set-up is needed.

23MAC address vs IP address

MAC is fixed by the manufacturer and stays the same, written in hex. IP is given by the network and can change, written in denary (IPv4) or hex (IPv6).

24private IP address

An address like 192.168.1.5 that works only inside a local network. The internet sees the router's public IP instead, and NAT translates between the two so many devices can share it.

25subnet mask

A number like 255.255.255.0 that splits an IP address into a network part and a device (host) part. With 255.255.255.0, the first three groups name the network.

26same network

Two devices are on the same network when their IP addresses have the same network part under the subnet mask. If the network part differs, data must go via the router.

27default gateway

The router address a device sends data to when the destination is not on its own network. It is usually the router's LAN address. With no gateway set, a device cannot reach the internet.

28domain name

An easy-to-remember name, like example.com, that stands in for a numeric IP address. It must be converted into the IP address before the computer can find the web server.

29https://www.example.com/shop/index.html

A URL splits into protocol (https), domain name (www.example.com) and web page or file name (shop/index.html). Each part can be labelled.

30DNS

Domain name server: stores a list of domain names with their matching IP addresses. Give it a domain name and it returns the IP address. Many DNS servers exist across the internet.

31DNS lookup

The browser sends a domain name to a DNS server, which searches for it and returns the matching IP address. If it has no match, it passes the request to another DNS server.

32domain table

A list pairing each domain name with an IP address. A DNS server looks up a name in it. A missing or wrong entry sends users to the wrong place or nowhere.

33ping address

A command that sends a small test message to another device and reports whether it replied and how long the reply took in milliseconds. Example: ping 8.8.8.8

34nslookup example.com

A command that asks a DNS server for the IP address that matches a domain name. The reply shows which DNS server answered and the Address line with the site's IP.

35packet

A small piece of a larger file. Data is split into numbered packets so they share the network and a lost packet can be resent instead of the whole file.

36header, payload, trailer

The three parts of a packet, in order: the header (start) holds addresses and packet number, the payload (middle) holds the data, the trailer (end) marks the packet's end.

37packet header

The first part of a packet. It holds control information: the destination address, the originator's address and the packet number, used to deliver and reassemble the packet.

38packet number

A number in the packet header showing the packet's position in the whole message (e.g. packet 3 of 10), so packets that arrive out of order can be put back in the right order.

39packet switching

Data is split into packets that are sent separately, each routed on its own from router to router, then joined back together in the right order at the destination.

40routing

A router reads each packet's destination address in its header and picks the next router to send it to, so every packet's route is decided one step at a time.

41routing table

A list a router uses to pick where to send each packet. Each row has a destination network and a next hop. The default route 0.0.0.0 is used when no other row matches.

42different routes

Packets from one message can take different routes because each router picks the best available path at that moment, avoiding busy or broken links. Routes may take different lengths of time.

43packets arrive out of order

Packets take different routes, so they may reach the destination in a different order from the one sent, e.g. packet 5 before packet 4. Order is not guaranteed.

44reordering packets

After the last packet arrives, the receiving device uses the packet numbers in the headers to put the packets in the right order and joins the payloads to rebuild the message.

45TTL

Time to live: a number in a packet that drops by 1 at each router hop. When it reaches 0 the packet is discarded, so a packet stuck in a loop cannot circle forever.

46tracert example.com

Windows command (traceroute on Mac and Linux) that lists each router hop between your device and a site, with the time taken to reach each one. Stars (*) mean no reply.

47data path

The route data takes across a network, passing through devices like a router and ISP from the sender to the receiver (a server), then the reply travels back along the route.

48network simulator

Software like Filius where you place devices, set each IP address and subnet mask, connect them with cables, then send a ping to test they can reach each other.

49protocol

An agreed set of rules that devices follow so they can communicate, like HTTP for web pages. Both devices must use the same protocol to understand each other.

50TCP/IP model

A four-layer plan for network communication: application (HTTP), transport (TCP, UDP), internet (IP) and network access (Ethernet, Wi-Fi). Each layer has its own job.

51Internet Protocol (IP)

The protocol that puts source and destination IP addresses on each packet so routers can deliver it. It is best-effort: it does not guarantee a packet arrives.

52TCP

Transmission Control Protocol. It sets up a connection, numbers packets, checks each one arrived and resends any missing, so data arrives complete and in order. Web pages and email use it.

53UDP

User Datagram Protocol: sends packets with no connection and no resending. It is faster than TCP but data may be lost, so it suits live video, voice calls and online games.

55SMTP and IMAP

SMTP sends email from a client to a mail server and between servers. IMAP (or POP3) lets a client read email stored on the server. Each protocol has a different job.

56HTTP

Hypertext Transfer Protocol: the set of rules a browser and web server use to request and send web pages. It is the default protocol for the web and is used only for web pages.

57HTTP request and response

The browser sends an HTTP request asking for a page. The web server sends back an HTTP response with the page's HTML, or an error such as 404 page not found.

58URL -> DNS -> IP -> server -> HTML -> render

The ordered steps after you enter a URL: the browser asks DNS for the IP address, sends a request to the web server, gets HTML back, then renders the page.

59error detection

Checking received data, because it can be damaged in transit and the receiver cannot see the original. Spotting the error is the first step to fixing it.

60interference

Unwanted disturbance to a signal, such as electrical noise or crosstalk, that damages data as it travels and can cause bits to be lost, gained or changed.

61compare sent and received

Compare the data sent with the data received. Fewer bits or characters means loss, extra ones means gain, and the same length with different values means change.

63parity bit

One extra bit added to a group of bits (such as 7 data bits) so the total number of 1s follows a rule, even or odd, agreed by sender and receiver. It is used to detect errors.

64checksum

A value calculated from a block of data by a set rule and sent with it. The receiver repeats the calculation and compares the results. If they differ, an error occurred.

65checksum = sum(bytes) % 256

Add all the byte values in the block, then keep the remainder after dividing by 256 so the result fits in one byte. Example: 200+100+50=350, 350 mod 256 = 94.

66echo check

The receiver sends a copy of the received data back to the sender, who compares it with the original. A match means no error was detected; a mismatch means the data is sent again.

67ARQ

Automatic repeat query: the receiver checks data for errors and replies. If the data is bad or no reply arrives, the sender automatically resends it until it is received correctly.

68positive acknowledgement

A message sent by the receiver to tell the sender that data arrived without error. Often written ACK. It is sent only after the error check passes, so the sender can send the next data.

69negative acknowledgement

A message (NAK) the receiver sends to the sender when the error check fails, telling it the data arrived with an error so the sender must resend the same data.

70timeout

The set time a sender waits for an acknowledgement after sending data. If none arrives in time, it assumes the data was lost and resends it.

72hash function

A one-way function that turns any input into a fixed-length value. The same input always gives the same hash, a tiny change gives a very different one, and it cannot be reversed.

73hash comparison

Hash the file before and after transfer. If both hashes (checksums) match, the data is unchanged. A different hash shows the file was altered or tampered with, so its integrity is lost.

74interception

When someone copies data as it travels across a network through routers and other devices, so unprotected data can be read by anyone who intercepts it, for example on public Wi-Fi.

75man-in-the-middle attack

An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.

76Unsecured Wi-Fi

A network with no encryption, letting attackers intercept the data sent across it.

77Encryption

Turning a readable message into a scrambled, unreadable message using a key, so it can only be read again with decryption.

78plaintext

The original, readable data (text, file, image or message) before it is encrypted. Decrypting ciphertext with the correct key turns it back into plaintext.

79ciphertext

The scrambled, unreadable data made when plaintext is encrypted. It is what gets sent across a network and looks meaningless without the key.

80encryption key

A secret value used by the encryption algorithm to scramble data into ciphertext and unscramble it again. A different key gives different ciphertext, and a longer key is harder to guess.

81Symmetric encryption

Using the exact same secret key to both lock and unlock a message.

82Asymmetric encryption

Encryption that uses a linked pair of keys: a public key to encrypt data and a private key to decrypt it, with no shared secret key needed.

83public key

The half of a key pair that the owner shares openly. Anyone can use it to encrypt data sent to the owner, but it cannot decrypt that data. Only the matching private key can.

84private key

The secret half of a key pair. Only the owner keeps it, never sends it, and uses it to decrypt data that was encrypted with their public key.

85Encrypt with public key, decrypt with private key

The receiver shares their public key, the sender encrypts with it, and only the receiver's private key can decrypt it. No secret key is shared, so an interceptor sees only ciphertext.

86symmetric vs asymmetric

Symmetric: one shared secret key, fast but hard to share safely. Asymmetric: public and private key pair, no secret to share but slower. Often combined.

87HTTPS

HTTP plus SSL/TLS encryption. Plain HTTP sends readable text that can be intercepted; HTTPS scrambles data so intercepted data can't be read, and a certificate shows the site is genuine.

88SSL

Secure Socket Layer: a security protocol that encrypts data between a browser and web server, so intercepted data cannot be read. Used for logins and payments. TLS is its successor.

89SSL handshake

Browser asks the server for its digital certificate, checks it is genuine, then both agree an encryption key to begin a secure session.

91data in transit

Data moving across a network, such as email or web traffic. It is protected by encrypting it (e.g. HTTPS or a VPN) so intercepted data cannot be read.

92data at rest

Data stored on a device, server or backup, not moving. Protect it with encryption (disk or database) and access control, so a stolen laptop or backup is unreadable.

93VPN

A virtual private network creates an encrypted tunnel across a public network so a remote user can access a private network securely.

94WPA3

The newest Wi-Fi security standard. With a strong password it scrambles data in the air so outsiders can't read it. WPA2 is the older version. Open networks have no protection at all.

95Confidentiality

Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

96Integrity

Data stays accurate and unaltered unless an authorised person changes it. Accidental or deliberate changes break it, such as a tampered bank balance.

97Availability

Authorised users can reach data and systems when they need them, such as a school network that stays up. Attacks and hardware failure can reduce it.

98Authentication vs authorisation

Authentication checks who you are, like logging in. Authorisation decides what you can do once you are known, like which files you can open. Authentication always comes first.

99username and password

A username identifies who you are and can be shared. A password proves it is really you, so keep it secret and never share it. You use both together when logging in.

100strong password

A password that is long and hard for others to guess. It avoids names, birthdays and common words like password123, and it mixes letters, numbers and symbols.

101Weak password

A password that is short, common, or predictable, making it easy for attackers to guess or crack.

102brute-force attack

An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

103hash

A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

104salt

A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

105password manager

A tool that stores and fills in many passwords for you, kept safe behind one strong master passphrase that only you know.

106authentication factor

A type of proof that you are who you say you are: something you know (password, PIN), something you have (phone, key), or something you are (fingerprint, face).

107Multi-factor authentication

A login method that requires two or more independent proofs of identity, such as a password plus a one-time code.

108MFA methods

Ways to prove it's you: an SMS code, an authenticator app, a biometric like a fingerprint, or a physical security key. They differ in how easy they are to use and how strong they are.

109biometric authentication

Proves who you are using a physical or behavioural trait, such as a fingerprint, face or voice, that is matched against stored data. It can wrongly accept or reject users.

110Adaptive authentication

Login checks that change with risk signals like location, device or time. A known device gets an easy login; an unusual location triggers extra proof.

111MFA fatigue

A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

112user account management

An OS function that creates, stores and controls user accounts, so each user logs in with a username and password and gets their own settings, files and access rights.

113system security

An OS function that protects the computer and its data from unauthorised access and attack using logins, access rights, updates and security tools.

114access levels

Settings that give each user different rights to data: no access, read only, read/write or full control. Users only see and change what their role needs, protecting confidentiality and integrity.

115permission

A rule that lets an account read, write or execute a file or resource. Read only views it, write can change or delete it, and execute runs it as a program.

116rwxr-x---

Three groups of three letters for owner, group and others: r is read, w is write, x is execute and - means not allowed. Here the owner has rwx, group r-x, others nothing.

117principle of least privilege

Give every user, program and device only the minimum access it needs to do its job. This limits the damage if an account is stolen, and unneeded access should be removed.

118Role-based access control (RBAC)

A way to manage access by giving permissions to roles, like student, teacher or admin, then assigning each user a role. Changing a user's role changes what they can access.

119access control list (ACL)

A table attached to a resource, like a file or router, that lists which users or groups may access it and what they can do. If you are not listed, access is denied.

120access log

An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

121Firewall

A device or program that monitors and controls incoming and outgoing network traffic according to defined security rules.

122Firewall software

A program installed on a single device that filters its incoming and outgoing traffic using security rules.

123network firewall

A device or router feature between a local network and the internet that filters inbound and outbound traffic for every device behind it, not just one.

124allow inbound TCP 443

A firewall rule with an action (allow), a direction (inbound) and a port (TCP 443). It lets incoming web traffic through. A deny rule on a port, such as 23, blocks it.

125deny from 192.168.1.50

A firewall rule that blocks traffic from one IP address. Use a range like 192.168.1.0/24 to match a whole network, and allow to let only trusted addresses, such as the school network, in.

126default deny

A firewall checks rules from the top and uses the first match. A final default deny rule blocks anything not allowed by an earlier rule.

127MAC filtering

A router setting that only lets devices with MAC addresses on an allowed list join. It is easy to set up but weak, because a MAC address can be copied (spoofed).

128proxy server

A server between a user's device and the internet. It receives the user's web requests, passes them to the web server for the user, then returns the response. Used in schools and companies.

130ISM segmentation guideline

A rule that tells organisations to divide their network into separate zones and limit access between them, so a breach stays contained.

131ISM access controls guideline

A rule that tells organisations to only give people access to the parts of the network they actually need, after checking who they are.

132Intrusion detection system (IDS)

A system that monitors network traffic for suspicious activity and raises an alert when it finds it.

133Intrusion prevention system (IPS)

A system that sits inline in the traffic path, detects threats, and automatically blocks them before they reach the network.

134Antivirus software

A program that detects, blocks and removes malicious programs from a device.

135Operating system update

Installing the latest patches for the OS, fixing known security vulnerabilities and bugs.

136asset

Anything of value in a digital system that needs protecting, such as data, accounts, devices or services. Examples: a student database (data) or a school laptop (hardware).

137threat

Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.

138vulnerability

A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

139risk = likelihood x impact

Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

140Unauthorised access

Gaining entry to a network or system without permission, often to steal or damage data

141DDoS attack

A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.

142phishing

Sending many fake emails that look genuine to trick users into clicking a link or replying with personal details, so criminals can steal passwords and bank details.

143trust boundary

A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

144STRIDE

A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

145threat model table

A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.

146countermeasure

A solution chosen to stop a specific threat, such as a firewall for hacking, SSL for interception or anti-malware for malware, plus an explanation of how it works.

147Australian Privacy Principle 11

Requires organisations to protect personal information from misuse, loss, and unauthorised access, and to destroy it when no longer needed.

148access control

Naming the data to protect, then choosing controls like login, permissions, a firewall or encryption, and justifying each one with the risk it reduces.