1.3.3c Network Security — OCR H446

Threats to Networks

Networks face a wide range of security threats. Understanding them is the first step to defence:

Threat	Description
Malware	Malicious software including viruses (self-replicating code attaching to programs), worms (self-replicating, spread across networks without host), Trojans (disguised as legitimate software), ransomware (encrypts files, demands payment), spyware (monitors activity), adware.
Phishing	Fraudulent emails/websites that appear legitimate, tricking users into revealing credentials or installing malware. Spear phishing targets specific individuals.
DoS / DDoS attack	Denial of Service / Distributed DoS — overwhelming a server with traffic so legitimate users cannot access it. DDoS uses a botnet (many compromised machines). The aim is to make a service unavailable — NOT to steal data.
Man-in-the-middle (MITM)	An attacker secretly intercepts and possibly alters communication between two parties, each believing they are communicating directly with the other.
SQL injection	Malicious SQL code inserted into an input field (e.g. a login form) to manipulate the database — extracting, modifying or deleting data.
Brute force attack	Systematically trying every possible password/key combination until the correct one is found.
Social engineering	Manipulating people into divulging confidential information or granting access — exploits human psychology rather than technical vulnerabilities. Includes phishing, pretexting, baiting.

Firewalls

A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic based on predefined security rules.

Firewalls work by:

Packet filtering: examines each packet's header (source IP, destination IP, port number, protocol) and allows or blocks it based on rules. Simple and fast but cannot inspect packet content.
Stateful inspection: tracks the state of active connections. Allows only packets that are part of an established, legitimate connection. Blocks unsolicited incoming packets.
Application layer (proxy) firewall: inspects the full content of packets at the application layer — can detect and block specific application protocols (e.g. block all HTTP from certain sites).

Firewalls can be placed between: the internet and the internal network (perimeter firewall), or between network segments (e.g. between the corporate LAN and the DMZ).

A DMZ (Demilitarised Zone) is a separate network segment between two firewalls — public-facing servers (web, email, DNS) are placed here. If they are compromised, the internal network is still protected by the inner firewall.

Encryption

Encryption transforms plaintext into ciphertext using an algorithm and a key, so that only authorised parties with the decryption key can read it. It protects data in transit (e.g. HTTPS, VPN) and at rest (e.g. encrypted hard drives).

Symmetric Encryption

The same key is used for both encryption and decryption. Fast and efficient for large data. Problem: how to securely share the key with the other party without it being intercepted (key exchange problem). Examples: AES, DES.

Asymmetric Encryption

A mathematically linked key pair: a public key (shared openly) and a private key (kept secret). Data encrypted with the public key can only be decrypted with the private key. Solves the key exchange problem. Slower than symmetric. Examples: RSA, ECC.

How HTTPS uses both: asymmetric encryption is used to securely exchange a symmetric session key (solving the key distribution problem); then the faster symmetric encryption is used for the actual data transfer. This is called a hybrid approach.

Certificates and Public Key Infrastructure (PKI)

A digital certificate is an electronic document that binds a public key to an identity (e.g. a website domain). It is issued and digitally signed by a trusted Certificate Authority (CA) — e.g. Let's Encrypt, DigiCert.

When you connect to https://www.example.com, your browser checks the server's certificate: Is it signed by a trusted CA? Has it expired? Does the domain match? If yes, the connection is secure. This prevents MITM attacks — the attacker cannot produce a valid certificate for a domain they don't control.

VPNs (Virtual Private Networks)

A VPN creates an encrypted tunnel between a device and a VPN server over the public internet. Benefits:

Encrypts all traffic — protects against eavesdropping on public WiFi.
Hides the user's real IP address — the destination site sees the VPN server's IP.
Allows remote workers to securely access a corporate LAN over the internet.

VPN protocols: IPSec, OpenVPN, WireGuard. All use strong encryption.

Intrusion Detection and Prevention Systems (IDS/IPS)

An IDS monitors network traffic and alerts administrators when suspicious activity is detected. An IPS goes further — it actively blocks detected threats in real time. Both compare traffic against known attack signatures and look for anomalies in behaviour patterns.

Access Control and Authentication

Limiting who can access a network and its resources:

Username/password: most basic — susceptible to weak passwords and brute force.
Multi-factor authentication (MFA): requires two or more of — something you know (password), something you have (phone/token), something you are (biometric). Much harder to bypass even if one factor is compromised.
MAC address filtering: only allow devices with pre-approved MAC addresses to connect to the network. Limited security — MAC addresses can be spoofed.
Principle of least privilege: users and processes are only given the minimum level of access they need to perform their function. Limits the damage from a compromised account.

Exam tip: For DoS/DDoS questions — the goal is to make a service unavailable, NOT to steal data. DDoS uses a botnet of compromised machines controlled by the attacker. Always distinguish DoS (single source) from DDoS (distributed, many sources).

Exam tip: Symmetric vs asymmetric encryption is a common comparison question. Remember: symmetric = one shared key (fast, key distribution problem); asymmetric = public/private key pair (slower, solves key distribution). HTTPS uses both in a hybrid approach.

⚠ Common Mistakes

Saying a firewall prevents all attacks — firewalls block unauthorised network traffic but cannot stop phishing (social engineering), insider threats, or malware that arrives via authorised channels (email attachments). Defence in depth requires multiple layers.
Confusing virus and worm — a virus requires a host program to spread; a worm is self-contained and spreads across networks independently without needing a host file.
Saying asymmetric encryption is used for all HTTPS traffic — asymmetric (RSA) is only used during the initial handshake to exchange the session key. The actual data transfer uses the faster symmetric encryption. HTTPS uses a hybrid approach.

✓ Notes completed!

▶

Video coming soon

Click to advance · Arrow keys also work

Click slide or press arrow keys to navigate

✍

Worksheet — 1.3.3c Network Security

8 questions · 20 marks · instantly marked

Q1Explain the difference between a computer virus and a worm. Give one example of how each spreads.[4 marks]

✓ Mark scheme

Virus: self-replicating malicious code that attaches itself to a legitimate host program or file [1]; spreads when the infected file is shared and executed — e.g. via an infected email attachment or USB drive [1]. Worm: self-contained malicious program that replicates and spreads across networks independently — it does not need a host file [1]; spreads by exploiting network vulnerabilities or security holes, automatically scanning and copying itself to other computers — e.g. WannaCry spread through a Windows SMB vulnerability [1].

Q2Explain what a DDoS attack is and how it differs from a DoS attack. What is the goal of a DDoS attack?[3 marks]

✓ Mark scheme

DoS (Denial of Service): a single source floods a server with traffic so it cannot serve legitimate users [1]. DDoS (Distributed DoS): same principle but uses many compromised machines (a botnet) controlled by the attacker — much harder to block because traffic comes from many IP addresses [1]. Goal: to make a service unavailable to legitimate users — NOT to steal data; may be used for extortion, competitive sabotage, or political disruption [1].

Q3Explain the difference between symmetric and asymmetric encryption. How does HTTPS use both?[4 marks]

✓ Mark scheme

Symmetric: one shared key used for both encryption and decryption; fast; problem is securely sharing the key without interception (key distribution problem) [1]. Asymmetric: uses a mathematically linked public/private key pair; data encrypted with public key can only be decrypted with private key; solves key distribution problem; slower [1]. HTTPS hybrid: asymmetric encryption (RSA) is used during the TLS handshake to securely exchange a symmetric session key [1]; once the session key is agreed, the faster symmetric encryption (AES) is used for the actual data transfer — combining security of asymmetric with speed of symmetric [1].

Q4Explain what a Man-in-the-Middle (MITM) attack is and how digital certificates help prevent it.[3 marks]

✓ Mark scheme

MITM: an attacker secretly intercepts and possibly alters communication between two parties, each believing they are communicating directly with the other — e.g. intercepting a connection to a bank and presenting fake credentials to both parties [1]. Digital certificates bind a public key to a verified domain identity, signed by a trusted Certificate Authority (CA) [1]; when a browser connects to a site, it checks the certificate is signed by a trusted CA and matches the domain — an attacker cannot produce a valid certificate for a domain they don't own, so a forged site will show a browser warning [1].

Q5What is a DMZ (Demilitarised Zone) in network security? Describe its purpose.[3 marks]

✓ Mark scheme

A DMZ is a separate network segment isolated from both the public internet and the internal LAN, typically placed between two firewalls [1]; public-facing servers (web servers, email servers, DNS servers) are placed in the DMZ so they can be accessed from the internet [1]; if a server in the DMZ is compromised, the attacker cannot directly access the internal network — it is protected by the inner firewall [1]. This provides defence in depth: external users can reach public services without having access to the internal corporate network.

Q6Explain what multi-factor authentication (MFA) is and why it is more secure than a username and password alone.[2 marks]

✓ Mark scheme

MFA requires two or more of: something you know (password/PIN), something you have (phone/hardware token — e.g. one-time code), something you are (biometric — fingerprint/face) [1]. More secure because even if one factor is compromised (e.g. password stolen via phishing), the attacker still cannot access the account without the second factor — they would also need the user's physical phone or fingerprint [1].

Q7Explain what packet filtering is and give ONE limitation of this type of firewall.[2 marks]

✓ Mark scheme

Packet filtering: a firewall examines each packet's header (source IP, destination IP, port number, protocol) and compares it against a set of rules — either allowing or blocking the packet [1]. Limitation (any 1): it cannot inspect the content/payload of packets — malicious data within an allowed packet type (e.g. malware in an HTTP download) will pass through; it is stateless — it cannot distinguish between an unsolicited incoming packet and a reply to an outgoing request (stateful inspection is needed for that) [1].

Q8Describe the 'principle of least privilege' and explain how it reduces security risk in a network.[2 marks]

✓ Mark scheme

Principle of least privilege: users, processes, and systems are only granted the minimum level of access rights needed to perform their specific function [1]; reduces security risk because: if an account is compromised, the attacker can only access what that account is authorised to see — limiting the potential damage; malware running as a standard user cannot install system-level software or access other users' data [1].

Topic Quiz

1 of 15

You scored

out of 15

Card 1 of 15

Click to reveal

🎉

Complete!

Term	Definition

Threats to Networks

Firewalls

Encryption

Symmetric Encryption

Asymmetric Encryption

Certificates and Public Key Infrastructure (PKI)

VPNs (Virtual Private Networks)

Intrusion Detection and Prevention Systems (IDS/IPS)

Access Control and Authentication

Worksheet — 1.3.3c Network Security

Mini Test — 1.3.3c Network Security