What you'll learn
Network security is about protecting computers, networks and data from threats — malicious software, attackers, careless or dishonest people, and accidents. This guide explains the main threats (viruses, worms, Trojans, spyware, ransomware, hacking, pharming, social engineering, denial of service attacks and botnets), then the measures that defend against them: firewalls, antivirus software, strong passwords, two-factor authentication, biometrics, access rights, updates, encryption and backups. Throughout, it stresses a key exam idea: no single measure is enough. Security works in layers, and people are as important as technology.
Questions on this topic often describe an incident — a ransomware attack, a stolen password, a hospital network brought down — and ask you to explain the threat, its effect, and how it could have been prevented or its damage limited. Match each threat to the measures that actually address it.
Key terms and definitions
Malware — Software designed to damage a computer or gain unauthorised access to it.
Virus — Malware that attaches to files and spreads when they are run or shared.
Worm — Malware that copies itself across networks without needing a user to run it.
Trojan — Malware disguised as legitimate software.
Spyware — Malware that secretly records a user's activity, such as keystrokes.
Ransomware — Malware that encrypts or locks files and demands payment to release them.
Hacking — Gaining unauthorised access to a computer system.
Pharming — Redirecting users to a fake website, even when they type the correct address.
Social engineering — Manipulating people into giving away information or access.
Denial of service (DoS) attack — Flooding a server with traffic so that genuine users cannot access it. A distributed attack (DDoS) uses many devices.
Botnet — A network of infected computers controlled remotely by criminals.
Firewall — Hardware or software that filters network traffic using rules.
Two-factor authentication (2FA) — Proving identity with two different types of evidence, such as a password and a code sent to a phone.
Biometrics — Identifying people by physical features, such as fingerprints or faces.
Access rights — Permissions that control which files and systems each user can see or change.
Core concepts
Types of malware
Viruses need a host file and usually some user action — opening an infected attachment or running a program — to spread. They can corrupt or delete files and slow the computer.
Worms spread by themselves, exploiting security weaknesses to move from computer to computer across a network. They can use up bandwidth and spread extremely quickly.
Trojans trick users into installing them by looking useful — a free game, a fake update. Once installed, they can open a "back door" for attackers or install other malware.
Spyware watches what the user does. Keyloggers record every key pressed, capturing passwords and card numbers.
Ransomware encrypts the victim's files and demands payment, often in cryptocurrency, for the key. Attacks have shut down hospitals, councils and businesses. Paying does not guarantee files are returned, and it funds criminals.
Attacks on people and networks
Hacking means getting into a system without permission, whatever the intention. Hackers may steal data, change it, delete it or use the system to attack others.
Social engineering exploits trust, fear and urgency. An attacker may phone pretending to be IT support and ask for a password, or leave an infected USB stick in a car park. Shoulder surfing — watching someone type a PIN or password — is a simple form.
Pharming tampers with DNS settings or the user's computer so that typing a genuine address leads to a convincing fake site, which then collects login details.
A denial of service attack floods a server with so many requests that it cannot respond to genuine users. It does not steal data, but for a hospital, bank or online shop, being unavailable can cause serious harm. Botnets — thousands of infected computers, often including insecure smart devices — are used to launch such attacks and to send spam.
Insider threats come from employees or others with legitimate access. They are hard to prevent precisely because those people are already trusted.
Firewalls
A firewall examines traffic entering and leaving a network and blocks anything that breaks its rules, such as unauthorised incoming connections. It is an essential first barrier, but it cannot stop malware that arrives through permitted routes — an email attachment the user chooses to open, or an infected USB drive — and it cannot clean a computer that is already infected.
Antivirus software
Antivirus software scans files and compares them with a database of known malware signatures, and watches for suspicious behaviour. It must be updated regularly, because new malware appears constantly. Even up-to-date antivirus can miss brand-new malware for which no signature yet exists — a "zero-day" threat — which is another reason for layered defences.
Passwords and authentication
A strong password is long and mixes upper and lower case letters, numbers and symbols, avoiding names, dates, dictionary words and keyboard patterns. Using a different password for each account matters, because criminals try leaked username-and-password pairs on many sites.
Forcing users to change passwords very frequently can backfire: people choose predictable variations or write them down. Long passphrases, changed when there is evidence of compromise, are now widely recommended.
Two-factor authentication combines something you know (a password) with something you have (a phone or security key) or something you are (a fingerprint). If a password is stolen, the attacker still cannot log in without the second factor.
Biometrics
Fingerprint, face and iris recognition are quick and cannot be forgotten or easily shared. However, scanners can fail (wet or injured fingers), and if biometric data is stolen it cannot be changed like a password. Storing biometric data raises privacy concerns, particularly for children, so organisations usually need consent and must store it securely.
Access rights, monitoring and good practice
Giving each user only the access their role needs limits the damage from mistakes, insiders or stolen accounts. Networks can log login attempts and activity; patterns such as many failed logins can trigger alerts and account lockouts.
Everyday good practice includes locking screens when away from a desk, not opening attachments from unknown senders, downloading software only from trusted sources, and being careful on public Wi-Fi, where others on the network may intercept unencrypted data. Using HTTPS websites or a VPN reduces that risk.
Updates, encryption and disposal
Software patches close security weaknesses; delaying them leaves known holes open. Encryption scrambles data so that it is unreadable without the key, protecting it if intercepted or if a laptop is stolen. Before an old device is sold or recycled, it must be securely wiped, because ordinary deletion often leaves data recoverable.
Backups and ransomware
The best defence against losing data to ransomware is a recent backup kept offline or separate from the network. A backup drive that stays permanently connected can be encrypted along with everything else.
Defence in depth
No single measure stops every threat. Organisations combine firewalls, antivirus, updates, access rights, strong authentication, encryption, backups and staff training, so that a gap in one layer is covered by another.
Physical security
Not every threat arrives over the network. Physical security protects the hardware and the places where data is stored:
- locked server rooms and offices, with access controlled by keys, swipe cards or biometrics;
- CCTV and alarm systems to deter and record intruders;
- cable locks on laptops and desktops in public areas;
- secure disposal of old drives and printed documents, for example by shredding;
- protection against fire, flood and power cuts, such as fire suppression systems and uninterruptible power supplies (UPS).
A stolen laptop with unencrypted files is a data breach just as much as a hacked server, which is why encrypting portable devices is standard practice.
Security policies
Organisations set out their rules in a security policy: acceptable use of computers, password rules, what to do with suspicious emails, rules for using personal devices, and how to report incidents. Staff training ensures people know and follow the policy. A clear policy also helps when something goes wrong, because everyone knows who to tell and what to do first, such as disconnecting an infected computer from the network.
Worked examples
Example 1: Explaining a threat
Explain the difference between a virus and a worm. (2 marks)
Answer: A virus attaches itself to a file and spreads when that file is run or shared by a user (1). A worm spreads across a network by itself without needing a user to run it (1).
Example 2: Ransomware response
A company's files have been encrypted by ransomware. Its most recent backup is on an external drive kept in a locked cupboard. Should it pay the ransom?
Answer: No. Paying does not guarantee the files will be returned and funds criminal activity. Because the backup was kept offline, the company can remove the malware, restore the files from the backup and lose only the work done since the last backup. It should then investigate how the ransomware got in.
Example 3: Why 2FA helps
A user's password is stolen in a data breach at another website. Explain how two-factor authentication protects their email account.
Answer: To log in, the attacker would need the password and the second factor, such as a code sent to the user's phone. Without the phone, the stolen password alone is not enough.
Example 4: Protecting a small business
A small accountancy firm has five computers and stores clients' financial data. Recommend a set of security measures.
Answer: Use a firewall and up-to-date antivirus on each computer; install updates promptly; require strong, unique passwords with 2FA for email and cloud services; give staff access only to the client files they need; encrypt laptops; keep regular backups, including an offline copy; and train staff to recognise suspicious emails and phone calls.
Common mistakes and how to avoid them
- Saying a firewall removes viruses. Firewalls filter traffic; antivirus software detects and removes malware.
- Calling every threat a "virus". Name the specific type and describe how it spreads or what it does.
- Forgetting people. Social engineering bypasses technology; training is a security measure.
- Recommending paying ransoms. Explain why backups are the better response.
- Giving measures that do not match the threat. A strong password does not stop a DoS attack.
Exam technique for "Network Security and Threats"
- For each threat, be ready to give what it is, how it spreads or works, its effect, and a matching defence.
- In "recommend" questions, give several measures and say what each one protects against.
- For evaluation questions (biometrics in schools, password rules), give benefits and drawbacks, then a reasoned judgement.
- Avoid absolute claims such as "this makes the network completely safe".
Quick revision summary
- Malware: virus (needs a host and user action), worm (spreads itself), Trojan (disguised), spyware (records activity), ransomware (encrypts and demands payment).
- Attacks: hacking, social engineering, shoulder surfing, pharming, DoS/DDoS, botnets, insiders.
- Defences: firewall, antivirus (kept updated), strong unique passwords, 2FA, biometrics, access rights, logging, patches, encryption, secure wiping, offline backups and staff training.
- Security works in layers; no single measure is enough.