What you'll learn
Network security is about identifying the threats that computer systems and networks face and the methods used to prevent them. In OCR GCSE Computer Science (J277, section 1.4) you need to know the forms of attack — malware, social engineering (including phishing), brute-force attacks, denial of service attacks, data interception and theft, and SQL injection — and the common prevention methods: penetration testing, anti-malware software, firewalls, user access levels, passwords, encryption and physical security. This guide explains each threat, how it works, what damage it does, and which defences address it.
Exam questions typically present a scenario — a business suffering an attack, a school worried about its data — and ask you to identify the threat, explain how it works and recommend suitable prevention. The key skill is matching threats to the right defences.
Key terms and definitions
Malware — Malicious software designed to harm or gain unauthorised access to a computer system.
Virus — Malware that attaches to a file and spreads when that file is run or copied.
Worm — Malware that replicates itself and spreads across networks without user action.
Trojan — Malware disguised as legitimate software.
Ransomware — Malware that encrypts a user's files and demands payment for the key.
Spyware — Malware that secretly monitors and records user activity, such as keystrokes.
Social engineering — Manipulating people into revealing confidential information or giving access.
Phishing — Fraudulent emails or messages that appear to come from a trusted source, designed to trick people into revealing information.
Brute-force attack — Trying many possible passwords, often automatically, until the correct one is found.
Denial of service (DoS) attack — Flooding a server with requests so that it cannot respond to genuine users.
Data interception — Capturing data as it travels across a network.
SQL injection — Entering SQL code into an input box on a website to access or change a database.
Penetration testing — Authorised simulated attacks used to find weaknesses in a system.
Firewall — Software or hardware that monitors and filters network traffic according to rules.
Core concepts
Why security matters
Organisations hold valuable data: customer details, financial records, intellectual property, medical information. Attacks can cause data loss, financial loss, disruption to services, legal penalties for failing to protect personal data, and damage to reputation. Security aims to protect the confidentiality (only authorised people see data), integrity (data is not changed without permission) and availability (systems work when needed) of systems and data.
Malware
Viruses attach to files or programs and spread when the infected file is opened or shared. They can delete or corrupt files and slow systems.
Worms spread by themselves across networks by exploiting security weaknesses, and can consume bandwidth and spread very quickly.
Trojans pretend to be useful software — a game, a utility, a fake update. Once installed they may create a back door for attackers, steal data or install other malware.
Ransomware encrypts files and demands payment for the decryption key. Paying is no guarantee of recovery.
Spyware, including keyloggers, secretly records activity such as passwords and card numbers and sends it to attackers.
Social engineering and phishing
Social engineering targets people, who are often the weakest point in a system. Techniques include:
- Phishing — emails that appear to come from a bank, delivery company or the organisation's own IT department, asking the recipient to click a link and "confirm" login details on a fake site. Signs include urgent or threatening language, unexpected attachments, generic greetings, spelling errors and links whose real address differs from the displayed text.
- Pretexting / phone scams (vishing) — an attacker phones pretending to be from IT support or a bank to obtain passwords.
- Shouldering — watching someone enter a PIN or password.
- Blagging — inventing a scenario to persuade someone to give information or access.
The main defence is staff training, backed up by procedures such as never giving passwords over the phone and verifying requests independently.
Brute-force attacks
Attackers use software to try huge numbers of possible passwords — often starting with common passwords and dictionary words — until one works. Defences include:
- strong passwords that are long and use a mix of character types, so there are far too many combinations to try;
- account lockout after a number of failed attempts;
- two-factor authentication, so a correct password alone is not enough;
- CAPTCHA tests that stop automated attempts.
Denial of service attacks
A DoS attack floods a server with so many requests that it cannot respond to genuine users. A distributed DoS (DDoS) uses many compromised computers (a botnet), making it harder to block. The attack does not usually steal data, but it makes websites and services unavailable, causing lost sales, lost productivity and damaged reputation. Defences include firewalls configured to detect and block unusual traffic, specialist filtering services and spare capacity.
Data interception and theft
Data travelling across a network — especially an unsecured wireless network — can be captured using packet sniffing software. If the data is not encrypted, the attacker can read usernames, passwords and other sensitive information. Data can also be stolen physically, for example by copying it onto a USB drive or stealing a laptop. Encryption is the main defence: intercepted data is unreadable without the key.
SQL injection
Many websites store data in databases and use SQL to query them. If a website builds a query directly from what a user types into a form, an attacker can type SQL code instead of normal input. The database may then run that code, revealing, changing or deleting data — for example, listing every user's details instead of checking one login. Defences include input validation and sanitisation (rejecting or neutralising special characters), using parameterised queries that treat input as data rather than code, and limiting database access rights so the web application cannot do more than it needs.
Prevention methods
Penetration testing — an organisation employs ethical hackers to attack its systems with permission, in order to find and fix weaknesses before criminals exploit them. It may simulate an outside attacker or a malicious insider.
Anti-malware software — scans files and memory for known malware signatures and suspicious behaviour, and quarantines or removes threats. It must be updated regularly to recognise new malware.
Firewalls — examine incoming and outgoing traffic and block anything that does not meet the rules, such as unauthorised connections or traffic to certain ports. They stop many attacks at the boundary of the network but cannot stop threats that users let in, such as an attachment they open.
User access levels — users are given access only to the files and functions they need for their role. A receptionist might view appointments but not change payroll data. This limits the damage from mistakes, insiders or a stolen account.
Passwords — strong, unique passwords, changed if compromised, protect accounts. Policies may require minimum length and complexity; two-factor authentication adds a second layer.
Encryption — scrambles data so that it is unreadable without the key, protecting data in transit (such as HTTPS) and at rest (such as an encrypted laptop drive).
Physical security — locked server rooms, keycards, CCTV, alarms and secure disposal of old equipment prevent people physically accessing or stealing hardware and data.
Matching threats to defences
| Threat | Main defences |
|---|---|
| Malware | Anti-malware, firewalls, updates, user training, access levels |
| Phishing/social engineering | Staff training, verification procedures, email filtering |
| Brute force | Strong passwords, lockout, two-factor authentication |
| DoS | Firewalls and traffic filtering |
| Data interception | Encryption |
| SQL injection | Input validation, parameterised queries, access levels |
| Physical theft | Physical security, encryption of devices |
No single method protects against everything, so organisations use several layers of defence.
Consequences of attacks for organisations
When explaining why prevention matters, describe the impact of an attack:
- Financial loss — stolen money, lost sales during downtime, ransom demands, the cost of recovery and investigation.
- Data loss or corruption — records deleted or altered, which may be impossible to recover without backups.
- Legal penalties — under the Data Protection Act 2018, organisations that fail to protect personal data can be fined.
- Damage to reputation — customers may lose trust and take their business elsewhere.
- Disruption — services such as hospitals, schools and transport may be unable to operate.
Network policies
Many organisations combine technical defences with a written network policy that sets out acceptable use, password rules, what to do with suspicious emails, rules for personal devices and how incidents must be reported. Regular staff training keeps the policy effective. A policy turns individual defences into a coordinated approach, and it is a good point to include in extended answers about protecting an organisation.
Worked examples
Example 1: Identifying a threat
Staff at a company receive an email that appears to be from the IT department asking them to log in via a link to "keep their account active". Identify the threat and explain how to prevent it. (3 marks)
Answer: Phishing (1). The link leads to a fake website that collects staff login details (1). Staff should be trained to recognise phishing emails and to check with IT through a known contact before clicking links or entering details (1).
Example 2: Brute-force protection
Explain two ways a website can protect user accounts against brute-force attacks. (4 marks)
Answer: Lock the account after a set number of failed login attempts (1), so automated software cannot keep guessing (1). Require two-factor authentication (1), so even if the password is guessed, the attacker cannot log in without the second factor (1).
Example 3: SQL injection
Describe what SQL injection is and how it can be prevented. (3 marks)
Answer: An attacker types SQL code into an input box on a website so that it is executed by the database (1), allowing them to view, change or delete data (1). It can be prevented by validating and sanitising user input, or by using parameterised queries (1).
Example 4: Penetration testing
Explain why a bank might pay for penetration testing.
Answer: Ethical hackers attempt to break into the bank's systems with permission, revealing weaknesses that criminals could exploit. The bank can then fix them before a real attack happens, protecting customers' money and data.
Common mistakes and how to avoid them
- Saying a firewall removes viruses. Firewalls filter traffic; anti-malware removes malware.
- Describing SQL injection as "a virus". It is an attack on a database through input fields.
- Saying encryption stops data being intercepted. It does not stop interception; it makes intercepted data unreadable.
- Ignoring people. Many attacks succeed through social engineering; training is a key defence.
- Recommending one measure for every threat. Match defences to threats.
Exam technique for "Network Security"
- For each threat, know what it is, how it works, its effect and how to prevent it.
- In extended answers, structure by threat → defence, and use the scenario's details.
- Use technical vocabulary precisely: brute force, penetration testing, user access levels.
- Avoid saying anything makes a system "completely safe".
Quick revision summary
- Threats: malware (virus, worm, Trojan, ransomware, spyware), social engineering and phishing, brute force, DoS/DDoS, data interception and theft, SQL injection.
- Defences: penetration testing, anti-malware, firewalls, user access levels, strong passwords and 2FA, encryption, physical security.
- Match each threat to the defence that addresses it; use layers.