Network Security | OCR H446

Learning Objectives

By the end of this topic you will be able to:

Describe common network threats: malware, phishing, DoS/DDoS, man-in-the-middle, SQL injection

Explain countermeasures: firewalls, encryption, IDS, access control

Describe social engineering attacks and how to mitigate them

Explain penetration testing and its role in network security

Threats

Common Network Threats

Malware: software designed to damage, disrupt or gain unauthorised access. Types: virus (attaches to files), worm (self-replicating, spreads without host), ransomware (encrypts files, demands payment), trojan (disguised as legitimate software), spyware (collects user data).

Phishing: fraudulent emails/websites impersonating trusted entities to trick users into revealing credentials or downloading malware. Spear phishing is targeted at specific individuals.

DoS / DDoS: Denial of Service — floods a server with requests to overwhelm it. DDoS (Distributed) uses a botnet of compromised machines to amplify the attack, making it much harder to block.

Man-in-the-middle (MitM): attacker intercepts and potentially alters communication between two parties without either knowing. Mitigated by end-to-end encryption (TLS).

More Threats

SQL Injection & Social Engineering

SQL Injection: malicious SQL code is inserted into an input field that is passed directly to a database query. If unsanitised, the attacker can bypass authentication, read or delete data, or take over the database.

Example: entering ' OR '1'='1 into a login field can make a query always return true, granting access without a valid password.

Prevention: use parameterised queries / prepared statements, which treat all user input as data, never as executable SQL. Validate and sanitise all inputs.

Social Engineering: manipulating people rather than systems to obtain confidential information or access. Includes pretexting (fabricated scenario), baiting (USB drops), vishing (voice phishing) and shoulder surfing. Mitigated by staff training and clear security policies.

Countermeasures

Security Countermeasures

Technical Controls

Firewall: filters traffic by rules — blocks unauthorised inbound/outbound connections

Encryption: TLS/HTTPS encrypts data in transit; full-disk encryption protects stored data

IDS/IPS: Intrusion Detection/Prevention System monitors traffic for known attack signatures

Antivirus: detects and removes known malware using signature databases

Procedural Controls

Access control: least privilege — users only have permissions necessary for their role

MFA: multi-factor authentication requires multiple forms of verification

Staff training: phishing awareness, password policies, incident reporting

Penetration testing: ethical hackers actively probe for vulnerabilities before attackers do

Exam Practice

OCR H446 Style · 5 marks

A company's login page is vulnerable to SQL injection. Explain what SQL injection is, give an example of how it could be exploited, and describe one countermeasure.

[5 marks]

SQL injection is an attack where malicious SQL code is entered into an input field that is concatenated into a database query without sanitisation.

Example: entering ' OR '1'='1 into a username field causes the query to always evaluate as true, allowing login without valid credentials.

An attacker could also use '; DROP TABLE Users; -- to delete an entire table, causing data loss.

Countermeasure: use parameterised queries (prepared statements) — user input is passed as a parameter separate from the SQL structure, so it cannot be interpreted as executable code.

Input validation/sanitisation — strip or reject special characters such as quotes and semicolons from user input before it reaches the database.

Common Mistakes

Don't Lose Marks

Saying a firewall stops all attacks — a firewall filters traffic by rules, but cannot stop all threats. Phishing, insider threats, encrypted malware, and zero-day exploits can bypass firewalls. Multiple layers of defence are needed.

Confusing DoS and DDoS — DoS comes from one source; DDoS uses a distributed botnet of many compromised machines. This makes DDoS much harder to block by simply banning a single IP address.

Saying SQL injection is only relevant to login pages — any user input that reaches a SQL query without sanitisation is vulnerable: search boxes, form fields, URL parameters. SQL injection is one of the most widespread web vulnerabilities.