3.5d Network Security — AQA 8525

Network Security Threats

Social Engineering

Phishing

Deceptive emails/messages pretending to be from a trusted source (bank, employer). Tricks users into clicking malicious links or revealing passwords. Spear phishing is targeted at a specific person or organisation.

Social Engineering

Vishing & Smishing

Vishing: voice phishing — phone calls claiming to be from HMRC, a bank, etc. Smishing: SMS phishing — fake text messages. Both attempt to steal personal information or trick victims into calling premium rate numbers.

Malware

Malware Types

Virus: attaches to files, spreads when shared. Worm: self-replicates across networks without user action. Trojan: disguised as legitimate software. Ransomware: encrypts files, demands payment. Spyware: secretly monitors activity. Adware: displays unwanted adverts.

Network Attack

DoS / DDoS Attack

Denial of Service: floods a server with requests so it cannot respond to legitimate users. DDoS (Distributed): attack comes from many computers simultaneously (a botnet of infected machines). Makes websites/services unavailable.

Web Attack

SQL Injection

Inserting malicious SQL code into a web form (login, search) that gets executed by the database. Can allow attackers to: bypass login, dump all data, modify/delete database records.

Network Attack

Man-in-the-Middle

An attacker secretly intercepts and possibly alters communication between two parties. Both parties believe they are communicating directly. Can steal credentials, payment details, or inject malicious content.

SQL Injection Example

-- Normal login query:
SELECT * FROM users WHERE username = 'admin' AND password = 'mypassword'

-- Attacker enters: ' OR '1'='1 in the username field:
SELECT * FROM users WHERE username = '' OR '1'='1' AND password = 'x'
-- '1'='1' is always TRUE → bypass login!

Prevention: parameterised queries / prepared statements — the database treats user input as data, never as SQL code.

Network Security Measures

Network Defence

🛡 Firewall

Hardware or software that monitors and filters incoming/outgoing network traffic based on security rules. Packet filtering: checks source/destination IP, port number. Stateful: tracks connections. Blocks unauthorised access.

Access Control

🔐 Authentication

Strong passwords: long, complex, unique. Two-factor authentication (2FA): requires something you know (password) AND something you have (phone/code). Greatly reduces risk of compromised accounts.

Data Protection

🔒 Encryption

Scrambles data so it cannot be read without the key. Protects data in transit (HTTPS/TLS) and at rest (full-disk encryption). Even if intercepted, encrypted data is unreadable.

Malware Defence

🦠 Antivirus

Detects and removes malware using signature scanning (database of known malware) and heuristic analysis (suspicious behaviour detection). Must be kept up to date.

Policy

👤 Access Control

Least privilege: users only have access to what they need. User authentication: verify identity before granting access. Separate admin accounts from standard user accounts.

Physical

🔑 Physical Security

Locks, key fobs, security badges, CCTV. Prevent physical access to hardware — someone with physical access can bypass software security. Secure server rooms, lock computers to desks.

Summary — Threats vs Countermeasures

Threat	Type	Countermeasure
Phishing	Social engineering	User training, spam filters, 2FA
Malware (virus, worm, trojan)	Malware	Antivirus, keep OS updated, avoid suspicious downloads
DoS/DDoS	Network attack	Firewall, rate limiting, traffic filtering, CDN
SQL Injection	Web attack	Parameterised queries, input validation
Man-in-the-middle	Network attack	HTTPS/TLS encryption, certificate verification
Unauthorised access	Access control	Strong passwords, 2FA, access control policies

Exam tip: For each threat, be able to explain what it does and how it is prevented. Common question formats: "Describe how a phishing attack works" or "State one countermeasure for a DoS attack." Know that DDoS uses a botnet of many infected machines. SQL injection inserts malicious code into a database query.

⚠️ Common Mistakes

Confusing DoS and DDoS — DoS comes from one machine; DDoS comes from many (a botnet). DDoS is much harder to block.
Saying phishing "hacks the server" — phishing exploits HUMANS, not systems. It tricks people into revealing information.
Saying "antivirus prevents SQL injection" — SQL injection is a web application vulnerability; parameterised queries are the fix, not antivirus.

▶

Video coming soon

Key points

Phishing: fake emails trick users into revealing credentials; spear phishing = targeted
Malware: virus (spreads via files), worm (spreads via network), ransomware (encrypts data, demands payment)
DoS: floods a server; DDoS: from many infected machines (botnet)
SQL injection: malicious SQL code via web form to access/modify database; fix = parameterised queries
Countermeasures: firewall, antivirus, HTTPS, strong passwords + 2FA, access control

Click slide or press arrow keys to navigate

✍️

Worksheet — 3.5d Network Security

8 questions · 22 marks

Q1Describe how a phishing attack works. Include how a user might recognise one.[3]

✅ Mark scheme

Mark scheme

A phishing attack uses deceptive emails/messages that appear to come from a trusted source (bank, employer, government) [1]; they contain links to fake websites designed to steal login credentials, personal data, or financial information [1]; signs include: misspelled sender address, urgent language, suspicious links (hover to check URL), generic greetings like "Dear Customer" [1].

Q2Explain the difference between a DoS attack and a DDoS attack. Why is DDoS harder to defend against?[3]

✅ Mark scheme

Mark scheme

DoS (Denial of Service): flood of requests sent from a single machine to make a server unavailable [1]; DDoS (Distributed DoS): the same attack launched from many machines simultaneously (a botnet) [1]; DDoS is harder to defend because blocking one IP address does not stop the attack — the requests come from thousands of different IP addresses, making it difficult to distinguish malicious from legitimate traffic [1].

Q3What is SQL injection? Give one way to prevent it.[3]

✅ Mark scheme

Mark scheme

SQL injection is when an attacker inserts malicious SQL code into a web form or input field that gets executed by the database [1]; this can allow the attacker to bypass login, view/steal data, or modify/delete database records [1]; prevention: use parameterised queries (prepared statements) — the database treats user input as data, never as executable SQL code [1].

Q4What is the role of a firewall in network security?[2]

✅ Mark scheme

Mark scheme

A firewall monitors and filters incoming and outgoing network traffic based on predefined security rules [1]; it blocks unauthorised access attempts and can filter by source/destination IP address, port number, or protocol [1].

Q5Explain what two-factor authentication (2FA) is and why it improves security.[3]

✅ Mark scheme

Mark scheme

2FA requires two separate forms of verification to log in [1]; typically something you know (password) AND something you have (a phone app code, SMS code, or hardware token) [1]; even if an attacker steals the password, they cannot log in without the second factor — significantly reducing the risk of account compromise [1].

Q6State the difference between a virus and a worm.[2]

✅ Mark scheme

Mark scheme

A virus attaches to a host file and requires user action (opening/sharing the file) to spread [1]; a worm is self-replicating — it spreads automatically across networks without needing to attach to a file or requiring user action [1].

Q7What is a man-in-the-middle attack? How does HTTPS help prevent it?[3]

✅ Mark scheme

Mark scheme

A man-in-the-middle (MITM) attack is when an attacker secretly intercepts communications between two parties — both believe they are communicating directly [1]; the attacker can read, steal, or modify the data in transit [1]; HTTPS uses TLS/SSL encryption so even if the attacker intercepts the data, they cannot read or modify it without the decryption key [1].

Q8A hospital's IT manager wants to improve the hospital's network security. Suggest three measures they could implement and explain how each one helps.[3]

✅ Mark scheme

Mark scheme

Any three: Install a firewall — filters unauthorised network traffic [1]; implement 2FA — prevents access even if passwords are stolen [1]; use encryption — protects patient data in transit and at rest [1]; keep antivirus up to date — detects and removes malware [1]; enforce least-privilege access control — staff only access what they need, limiting damage from breaches [1]; physical security (locked server rooms) — prevents physical tampering [1].

✓

Check your answers above.

Topic Quiz

Q 1 of 10

You scored

out of 10

Card 1 of 8

Click to flip

🎉

All done!

Term	Definition

🔒

Pro Content

Subscribe to unlock all AQA 8525 lessons, worksheets, quizzes and mini tests.

£7.99/month

or £59/year

Upgrade to Pro

Network Security Threats

Phishing

Vishing & Smishing

Malware Types

DoS / DDoS Attack

SQL Injection

Man-in-the-Middle

SQL Injection Example

Network Security Measures

🛡 Firewall

🔐 Authentication

🔒 Encryption

🦠 Antivirus

👤 Access Control

🔑 Physical Security

Summary — Threats vs Countermeasures

Key points

Worksheet — 3.5d Network Security

Mini Test — 3.5d Network Security