§1.4 Network Security

Security is always an arms race: every attack has a defence, every defence has a bypass. The OCR spec frames §1.4 around this pairing — knowing each form of attack (how it works, what the attacker wants) and the corresponding prevention method. The most effective defences are layered: a firewall stops external intrusion, encryption protects data in transit, access levels limit what an authenticated user can reach, and anti-malware catches anything that slips through.

Humans are often the weakest link. Social engineering — tricking users into revealing passwords or clicking malicious links — bypasses technical defences entirely. This is why training and authentication controls matter as much as firewalls. SQL injection attacks target databases through poorly-validated inputs: an attacker enters SQL code into a form field, and if the input isn't sanitised, the database executes it as a real query, potentially exposing or deleting all the data.

Attack ↔ Defence pairing

Malware (virus, ransomware, spyware) → anti-malware software; firewalls; user access levels

Social engineering / phishing → staff training; strong authentication; email filters

Brute force attack → strong passwords; account lockout; CAPTCHA; rate limiting

DoS (Denial of Service) → firewalls; rate limiting; traffic filtering

Data interception → encryption; HTTPS; secure connections

SQL injection → input validation; parameterised queries; access levels

What students must understand

Malware: software designed to damage, disrupt, or gain unauthorised access; includes viruses, ransomware, spyware, trojans

Social engineering: exploiting people, not systems; phishing = fraudulent emails/messages to obtain credentials

Brute force: systematically trying all possible passwords or keys until one works

Denial of Service (DoS): flood a server with requests so it cannot serve legitimate users

Data interception and theft: capturing data as it travels across a network (e.g. unencrypted Wi-Fi)

SQL injection: malicious SQL entered into an input field is executed by the database; can expose, alter, or delete data

Penetration testing: authorised simulated attacks to identify vulnerabilities before real attackers do

Anti-malware: scans for and removes malicious software; must be kept up to date

Firewalls: monitor and filter incoming/outgoing traffic based on rules; block unauthorised access

User access levels: limit what each user can read, write, or delete; principle of least privilege

Passwords: strong (long, mixed characters); changed regularly; never shared

Encryption: scrambles data in transit so interceptors cannot read it

Physical security: locked server rooms, CCTV, secure devices — prevents physical access to hardware

Diagrams

Sketchnote of social engineering themes: access, login, spying, fraud, passwords, security, influence and pretext

Social engineering targets the person, not the machine.

A phishing text message offering a fake tax refund with a fraudulent HMRC link

A phishing text. Urgency, a refund hook and a fake HMRC web address.

Diagram of a firewall as a brick wall between a LAN and the wider network

A firewall sits between the LAN and the wider network, filtering traffic in both directions.

Diagrams: PG Online (Paul Long), OCR J277 textbook. Used under the school site licence.

Attack ↔ Defence pairing

What students must understand

Diagrams

Linking questions

Practice

Video Support