Network Security: Threats and Prevention
Every threat on the specification explained by how it actually works, every prevention method, and the reason the biggest weakness in any network is a person.
Forms of attack
Malware
Malware is any software written to cause harm. The main types:
- Virus. Attaches itself to a file or program and spreads when that file is opened or shared. It needs a host file and a user action.
- Worm. Spreads by itself across a network without any user action, which makes it spread very fast.
- Trojan. Disguises itself as legitimate software. The user installs it willingly, and it then does something harmful.
- Ransomware. Encrypts the victim's files and demands payment for the key.
- Spyware. Secretly records activity, such as keystrokes, and sends it to an attacker.
A virus needs a host file and someone to open it. A worm spreads on its own. Getting this distinction right is worth a mark.
Social engineering
Social engineering is manipulating people rather than attacking technology. The target is human trust, not a software flaw.
- Phishing. Fraudulent emails or messages pretending to be from a legitimate organisation, designed to trick the victim into revealing passwords or bank details, or into clicking a malicious link.
- Shouldering or shoulder surfing. Watching someone enter a PIN or password.
- Blagging or pretexting. Inventing a scenario to gain trust, such as phoning an employee while pretending to be from IT support and asking for their password.
- Name generator attacks. Quizzes asking for your first pet and street name, which are common security question answers.
Technical defences can be very strong, but a person can be persuaded to hand over a password, and no firewall can stop an attacker who has been given valid credentials.
Brute force attack
Trying every possible combination of characters until the correct password is found, usually automated so millions of attempts are made per second.
Defences: strong long passwords, limiting the number of login attempts, and two factor authentication.
Denial of service attack
A DoS attack floods a server with so many requests that it cannot respond to genuine users, so the service becomes unavailable.
A DDoS, distributed denial of service, uses many compromised machines at once, which makes it far harder to block because the traffic comes from thousands of different addresses.
Data interception and theft
Data is captured while travelling across a network, for example by packet sniffing on an unencrypted public Wi-Fi network. The attacker reads the traffic and extracts passwords or personal information.
Defence: encryption. Intercepted data is then unreadable.
SQL injection
A website that builds a database query directly from user input can be attacked by typing SQL code into an input box. If the input is not checked, the database executes the attacker's code, which can reveal, alter or delete data.
Example: entering ' OR '1'='1 into a login box may make the condition always true, granting access without a password.
Defence: validation of all input, and parameterised queries that keep data separate from code.
- Malware: virus, worm, trojan, ransomware and spyware.
- Social engineering: phishing, blagging and shouldering trick people instead of computers.
- Brute force: try every combination until one works.
- Denial of service: flood a server so real users cannot get in.
- SQL injection: database code typed into an input box.
- Interception: reading data as it travels, for example on public Wi-Fi.
- The sender's address does not match the real organisation.
- The message is urgent and threatens you, to stop you thinking.
- It says Dear Customer instead of using your name.
- Spelling and grammar mistakes.
- The link goes somewhere different to what it says, which you can see by hovering over it.
- An attachment you were not expecting, here a program file.
Preventing attacks
Penetration testing
Deliberately attacking your own system, with permission, to find weaknesses before a real attacker does. The report identifies vulnerabilities so they can be fixed.
Anti malware software
Scans files against a database of known malware signatures and monitors behaviour for suspicious activity. It quarantines or removes anything it finds. It must be kept up to date, because new malware appears constantly.
Firewalls
A firewall sits between a network and the outside world and inspects incoming and outgoing traffic, blocking anything that does not meet its rules. It can block specific ports, addresses or applications.
User access levels
Different users are given different permissions, so each person can access only what their role requires. A student cannot see staff files, and a teacher cannot change system settings.
This limits the damage a compromised account can do, and reduces accidental damage too.
Passwords
Strong passwords are long, mix character types and avoid dictionary words and personal information. Combined with a limit on login attempts, they defeat brute force attacks. Two factor authentication adds a second requirement, so a stolen password alone is not enough.
Encryption
Data is scrambled using a key so that it is meaningless to anyone without the key.
Encryption does not stop data being intercepted. It makes intercepted data useless. That distinction is frequently tested.
Physical security
Locked server rooms, keycard access, CCTV and alarms. No amount of software security helps if someone can walk out with the server.
Questions often give a threat and ask for a suitable prevention. Learn the pairs: brute force pairs with strong passwords and attempt limits, interception pairs with encryption, SQL injection pairs with input validation, malware pairs with anti malware and firewalls, social engineering pairs with staff training.
- You start with plaintext: the message as anyone could read it.
- A key and an algorithm turn it into ciphertext.
- The ciphertext is what travels, and it is what an attacker sees.
- The right key reverses it. The wrong key gives nothing useful.
- Hashing is different: it is one way, and there is no way back.
- No single defence is enough, so several layers are used. An attacker has to get past all of them.
- Match each threat to the defence that answers it. This pairing is asked in the exam.
- A common word is cracked at once, however long it feels to type.
- Eight random characters from 95 symbols: about 6.6 quadrillion possibilities.
- Five random words from a list: far more possibilities, and easier to remember.
Key terms you must be able to define
- Malware
- Software written with the intention of causing harm to a computer system or its data.
- Virus
- Malware that attaches to a host file and spreads when that file is opened or shared.
- Worm
- Malware that spreads itself across a network without needing any user action.
- Trojan
- Malware disguised as legitimate software that the user installs voluntarily.
- Ransomware
- Malware that encrypts files and demands payment for the decryption key.
- Social engineering
- Manipulating people into revealing information or performing actions that compromise security.
- Phishing
- Fraudulent messages imitating a legitimate organisation in order to obtain personal information.
- Brute force attack
- Systematically trying every possible password combination until the correct one is found.
- Denial of service
- Flooding a server with requests so that it cannot respond to legitimate users.
- SQL injection
- Entering SQL code into an input field so that an unprotected database executes it.
- Penetration testing
- Authorised simulated attacks on a system to identify weaknesses before criminals find them.
- Firewall
- Hardware or software that inspects network traffic and blocks anything not meeting its rules.
- Encryption
- Scrambling data using a key so it cannot be understood by anyone who intercepts it.
- User access level
- A permission setting that controls which files and features a particular user can reach.
Flashcards
Say the definition out loud before you flip the card. Retrieving it from memory is what builds recall, reading it again is not.
Reach the top grade on this topic
The marks on this topic are almost entirely about mechanism and matching.
Explain how, not what. A grade 5 answer says "a firewall protects the network". A grade 9 answer says "a firewall examines every packet entering and leaving the network and blocks any that do not match its rule set, for example traffic to a port that should not be in use".
Match the defence exactly to the threat in the question. If the scenario is staff being tricked by fake emails, the answer is training and awareness, not a firewall. A firewall does nothing against an employee who types their password into a convincing fake login page.
Be precise about encryption. Encryption does not prevent interception. It prevents intercepted data from being understood. Examiners specifically look for this.
Give the strongest answer on human factors. Every technical control can be undone by a person, which is why staff training is a genuine security control and not an afterthought.
- Define every threat with its mechanism in one sentence
- Pair each threat with the most appropriate prevention and say why
- Explain why a network needs several layers of defence rather than one
- Explain user access levels in terms of limiting damage, not just restricting access
Mistakes that cost marks here
- Saying encryption stops data being intercepted. It stops it being understood.
- Describing a firewall as 'antivirus'. A firewall filters network traffic, anti malware scans files.
- Saying a virus and a worm are the same. A worm needs no user action and no host file.
- Recommending a technical control against a social engineering attack. Training is the answer there.
- Saying penetration testing 'stops attacks'. It finds weaknesses so they can be fixed before attackers exploit them.
- Giving 'use a strong password' as the answer to everything. Match the control to the specific threat.
The most successful phishing emails are not the badly spelled ones. They are the ones that create urgency: a fake message saying your account will be closed in 24 hours defeats careful thinking, because panicking people stop checking details.
Knowledge check
Exam-style questions
Five written questions in the style of the real paper. Write a full answer, then let the marker check it against the mark scheme.
- LManipulating or tricking people rather than attacking the technology
- LThe aim is to obtain confidential information or access
- LGives a valid example such as phishing, blagging or shouldering
Social engineering is the practice of manipulating people rather than attacking a system's technology, in order to obtain confidential information such as passwords or to persuade someone to grant access they should not. It works because human trust and helpfulness can be exploited in ways that technical defences cannot prevent. One example is phishing, in which an attacker sends an email that appears to come from a legitimate organisation such as a bank, containing a link to a convincing fake login page, so that the victim enters their username and password and hands them directly to the attacker.
- LA virus attaches itself to a host file or program
- LA virus requires a user action such as opening the file in order to spread
- LA worm replicates and spreads across a network on its own without user action
A virus is malware that attaches itself to a host file or program, and it only spreads when a user carries out an action such as opening that file, running the program or sharing it with somebody else. A worm, by contrast, is self replicating and spreads itself across a network without needing any user action or host file at all, which means it can move between machines far faster and infect a whole network in a very short time.
- LThe attacker enters SQL code into an input field instead of normal data
- LIf the input is not checked it is passed into the database query and executed
- LThis could allow the attacker to bypass the login or read, change or delete data
- LPrevention: validate and sanitise all user input, or use parameterised queries
An SQL injection attack is carried out by typing SQL code into an input field on the login form rather than a normal username or password. If the website builds its database query by inserting that text directly and does not check what has been entered, the attacker's code becomes part of the query and is executed by the database. For example, entering a fragment that makes the condition always evaluate to true could allow the attacker to log in as any user without knowing a password, and further injected statements could read, modify or delete the contents of the customer table. The company can prevent this by validating and sanitising all user input so that characters and keywords used in SQL are rejected or escaped, and more reliably by using parameterised queries, which keep the user's data strictly separate from the SQL code so that it can never be executed as an instruction.
- LInstall anti malware software
- LKeep it updated so new threats are recognised
- LUse a firewall to filter network traffic
- LApply user access levels so students cannot install software
- LTrain staff and students to recognise suspicious emails and attachments
- LKeep operating systems and applications patched
First, the school should install anti malware software on every machine and configure it to update automatically. Anti malware compares files against a database of known malware signatures and monitors for suspicious behaviour, quarantining anything it detects, but new malware appears constantly so the signature database must be kept current or recent threats will pass straight through. Second, the school should use a firewall between its network and the internet. A firewall inspects all incoming and outgoing traffic and blocks anything that does not meet its rules, which prevents malware from communicating with external servers and stops many infections reaching the network in the first place. Third, the school should set user access levels so that students and most staff cannot install software or alter system files. This means that even if a user is tricked into running something malicious, the malware inherits only that account's restricted permissions and cannot spread across the whole system. Alongside these, training staff and students to recognise suspicious emails and attachments addresses the human route that most infections actually take, and keeping operating systems and applications patched closes the software vulnerabilities that malware exploits.
- LData on a wireless network travels through the air and can be intercepted
- LEncryption scrambles the data using a key so it is unreadable
- LWithout the key an attacker who intercepts the data cannot understand it
On a public wireless network the data travels through the air as radio waves, and anyone within range with the right software can capture that traffic without the sender being aware, which is known as packet sniffing. Encryption protects against this by scrambling the data using a key before it is transmitted, so that what is actually broadcast is meaningless. Encryption does not prevent the data from being intercepted, but an attacker who captures it has only unreadable ciphertext, and without the decryption key they cannot recover the original information such as passwords or bank details.