Networks, protocols and cyber security
Computer Science · GCSE · The School
Two machines built by different companies, in different decades, exchange data reliably because both follow the same agreed rules. That agreement is a PROTOCOL. TCP guarantees that everything arrives and arrives in order, by numbering segments and demanding acknowledgement. IP handles addressing and routing between networks. HTTP carries the request for a page; HTTPS is the same request inside an encrypted channel. None of these is a piece of software you install. Each is a specification that many different pieces of software agree to obey.
The stack is divided so that each layer solves one problem and trusts the layer below. HTTP does not know or care whether the data travels over fibre, copper or radio, because that is the physical layer's problem. Wi-Fi can be replaced by 5G without a single web page being rewritten. This is the same idea as a function in a program: a boundary you can reason about, and change behind, without disturbing what sits above it. Layering is why the internet could be rebuilt underneath the web while the web kept working.
HTTPS means the traffic between your device and the server is unreadable to anyone in between — the cafe Wi-Fi, the internet provider, anyone with a packet capture. The padlock says exactly that and no more. It does not say the site is honest, that the company is safe, or that your data will not be sold once it arrives. A phishing site can hold a perfectly valid certificate, because a certificate proves you are talking to that domain, not that the domain deserves trust.
Technical defences have improved sharply, which is why most successful breaches now target the person. PHISHING sends a message that impersonates something you trust and manufactures urgency, because urgency suppresses checking. Pretexting invents a plausible reason to need your details. Shouldering and USB drops need no network at all. Consider the shape of a real attack: an email appears to come from your bank, the domain is banksecure-verify.co.uk rather than the bank's own, it insists your account closes in two hours, and the link opens a page carrying a valid padlock. Every technical control performed correctly. The defence is not a stronger firewall; it is noticing that no bank imposes a two-hour deadline, and reaching the site by typing the address you already know.