AQA 7517 · A-Level Computer Science · ~16 min read
Network Threats
Threat
Description
Malware
Malicious software: viruses (self-replicate), worms (spread without user action), ransomware (encrypts files, demands payment), Trojans (disguised as legitimate software), spyware (secretly collects data)
Phishing
Fraudulent emails/websites that trick users into revealing credentials or downloading malware
Brute force attack
Systematically trying all possible passwords until correct one found. Mitigated by account lockout policies and strong passwords.
SQL injection
Malicious SQL inserted into input fields to manipulate a database. E.g. entering ' OR 1=1-- to bypass login.
DoS / DDoS attack
Denial of Service — flood a server with requests to crash it. DDoS uses many compromised machines (botnet).
Man-in-the-middle
Attacker intercepts communication between two parties to eavesdrop or modify data.
Social engineering
Manipulating people into revealing confidential information (e.g. impersonating IT support)
Encryption
Symmetric encryption: same key used for both encryption and decryption. Fast but key must be shared securely (key distribution problem). Examples: AES, DES.
Asymmetric (public key) encryption: uses a public key (encrypt) and private key (decrypt). Public key can be shared freely. Used in TLS/HTTPS. Slower but solves key distribution. Example: RSA.
TLS/SSL: used in HTTPS — uses asymmetric encryption to exchange a symmetric session key, then symmetric encryption for fast data transfer (hybrid approach)
Digital certificate: issued by a Certificate Authority (CA) — proves a website's identity and contains its public key
Firewalls
A firewall monitors and filters incoming/outgoing network traffic based on security rules.
Packet filtering: examines packet headers (IP, port, protocol) and blocks based on rules
Stateful inspection: tracks the state of connections — rejects packets not part of an established connection
Application-level gateway (proxy): inspects application-layer data (e.g. blocks specific URLs)
Can be hardware or software; sits between the LAN and the internet
Authentication Methods
Passwords: weak if short or reused; strengthened by hashing (bcrypt, SHA-256) and salting (random data added before hashing to prevent rainbow table attacks)
Multi-factor authentication (MFA): requires two or more of: something you know (password), something you have (phone/OTP), something you are (biometric)
Biometrics: fingerprint, retina, face — difficult to forge but cannot be changed if compromised
Digital signatures: hash of document encrypted with sender's private key — proves authenticity and integrity
VPNs
A VPN (Virtual Private Network) creates an encrypted tunnel over the public internet, allowing remote users to securely access a private LAN as if locally connected. Used by businesses for remote workers.
Exam tip: For AQA 7517 Paper 2, security questions often ask you to explain a specific threat and a corresponding countermeasure. Learn the pair: SQL injection → parameterised queries; phishing → email filters + user education; brute force → account lockout; DDoS → rate limiting, CDN. Symmetric vs asymmetric: know that HTTPS uses asymmetric to exchange a symmetric key (hybrid). Always explain WHY a countermeasure works.
▶
Click through the slides at your own pace. Use arrow keys or click to advance.
Click slide or press arrow keys to navigate
Worksheet — 4.9.3b Network Security
8 questions · instantly marked · AQA 7517 standard
Q1Explain what a SQL injection attack is and describe one way to prevent it.[2]
✅ Mark scheme
Mark scheme
SQL injection: attacker enters malicious SQL code into an input field [1]; the database executes the code unintentionally, potentially revealing or destroying data [1]; example: entering ' OR 1=1-- to bypass authentication [1]. Prevention: use parameterised queries (prepared statements) — input is treated as data, not executable SQL [1].
Q2Explain the difference between symmetric and asymmetric encryption. State one advantage of each.[4]
✅ Mark scheme
Mark scheme
Symmetric: same key used for encryption and decryption [1]; advantage: fast — lower computational overhead [1]. Asymmetric: uses a key pair — public key encrypts, private key decrypts [1]; public key can be shared freely [1]; advantage: solves key distribution problem — no need to share a secret key [1]. HTTPS uses asymmetric to exchange a symmetric session key (hybrid) [1].
Q3Describe what a DDoS attack is and explain why it is more difficult to defend against than a standard DoS attack.[2]
✅ Mark scheme
Mark scheme
DDoS (Distributed Denial of Service): many compromised computers (a botnet) simultaneously flood a server with requests, overwhelming it [1]; standard DoS has a single source — easily blocked by IP [1]; DDoS uses thousands of different IPs making it much harder to block [1]; traffic appears legitimate [1].
Q4Explain what password hashing and salting are, and why both are used together.[2]
✅ Mark scheme
Mark scheme
Hashing: password is passed through a one-way hash function (e.g. SHA-256); only the hash is stored — the original password cannot be recovered [1]. Salt: a random value added to the password before hashing [1]; ensures identical passwords produce different hashes [1]; prevents rainbow table attacks (pre-computed hash lists) [1].
Q5Explain how a firewall protects a network. State the difference between packet filtering and stateful inspection.[2]
✅ Mark scheme
Mark scheme
Firewall: monitors and filters incoming/outgoing traffic based on rules [1]; blocks unauthorised access. Packet filtering: examines each packet's header (IP, port, protocol) against rules — does not consider context [1]. Stateful inspection: tracks the state of active connections [1]; rejects packets that are not part of an established, legitimate connection [1].
Q6Explain what multi-factor authentication (MFA) is and why it is more secure than a password alone.[2]
✅ Mark scheme
Mark scheme
MFA: requires two or more authentication factors from different categories [1]: something you know (password), something you have (phone OTP), something you are (biometric) [1]. More secure: even if a password is compromised, an attacker still needs the second factor [1].
Q7Describe how a phishing attack works and state two ways to defend against it.[3]
✅ Mark scheme
Mark scheme
Phishing: fraudulent email or website impersonates a trusted organisation [1]; tricks users into revealing credentials or downloading malware [1]. Defences: email filters that detect suspicious senders/links [1]; user training/awareness [1]; MFA so stolen passwords alone are insufficient [1].
Q8Explain what a VPN is and how it provides security for a remote worker.[3]
✅ Mark scheme
Mark scheme
VPN: Virtual Private Network — creates an encrypted tunnel over the public internet [1]; allows the remote worker to access the company's private LAN securely [1]; all data is encrypted so even if intercepted, it cannot be read [1]; the worker's device appears to be on the local network [1].
Topic Quiz
Question 1 of 15
You scored
out of 15
Card 1 of 8
Click to reveal definition
🎉
All cards reviewed!
Term
Definition
🎯
Mini Test — Network Security
10 questions · 10 minutes
⏱ 10:00
Section A — Multiple Choice [5 marks]
Q1A SQL injection attack works by:
Q2Asymmetric encryption uses:
Q3A DDoS attack is different from a DoS attack because:
Q4Salting a password before hashing prevents:
Q5A VPN creates:
Section B — Short Answer [5 marks]
Q6State what a botnet is and how it is used in a DDoS attack.
Mark schemeBotnet: a network of compromised computers (infected with malware) controlled remotely [1]; used to simultaneously send massive volumes of traffic to a target server, overwhelming it [1].
Q7State two pieces of information a digital certificate contains.
Mark schemeAny two: the website's public key [1]; identity of the website/owner [1]; name of the Certificate Authority (CA) [1]; expiry date [1].
Q8Explain the difference between a virus and a worm.
Mark schemeVirus: attaches to an existing file; requires user action (opening the file) to spread [1]. Worm: self-replicates and spreads across networks without user action [1].
Q9Why is a password alone insufficient to secure a bank account?
Mark schemePasswords can be stolen via phishing, data breaches, or brute force [1]; a second factor (e.g. OTP to phone) ensures that knowing the password alone is not enough to access the account [1].
Q10Explain what stateful inspection in a firewall does.
Mark schemeStateful inspection: tracks the state of active network connections [1]; rejects incoming packets that are not part of an established, legitimate connection — more secure than simple packet filtering [1].