You are viewing a free preview of this lesson.
Subscribe to unlock all 10 lessons in this course and every other course on LearningBro.
This lesson brings together everything you have learned about network security in OCR J277 Section 1.4. We will review the key topics, practise exam-style questions, and develop effective techniques for answering security questions in the OCR GCSE Computer Science Paper 1 exam.
Before the exam, make sure you can confidently explain each of the following:
| Topic | Key Points to Remember |
|---|---|
| Malware types | Virus (needs host), worm (self-replicating), trojan (disguised), ransomware (encrypts files), spyware (monitors), adware (adverts) |
| Social engineering | Phishing (fake emails), pharming (DNS redirect), shouldering (observation), blagging (false identity) |
| SQL injection | Malicious SQL in input fields; prevent with input validation and parameterised queries |
| Penetration testing | Authorised testing; black/white/grey box; find vulnerabilities before attackers |
| Firewalls | Monitor and control traffic based on rules; cannot stop all threats |
| Proxy servers | Intermediary; hides IP, filters content, caches pages |
| Encryption | Symmetric (one key, fast), asymmetric (two keys, solves key distribution) |
| Authentication | Passwords, biometrics, 2FA; three factors: know, have, are |
| Network policies | AUP, password policy, backup policy, disaster recovery |
| Physical security | Locked rooms, CCTV, biometric access, cable locks |
Network security questions in OCR J277 Paper 1 typically appear as:
OCR Exam Tip: For extended-response questions, structure your answer with clear paragraphs. Discuss multiple threats and multiple prevention methods. Use specific terminology (e.g. "two-factor authentication" not "extra security"). Link each threat to a specific prevention method.
Question: State what is meant by the term 'social engineering' in the context of network security. (2 marks)
Model answer: Social engineering is the manipulation of people (1) into revealing confidential information or performing actions that compromise security (1).
Question: Describe how SQL injection can be used to gain unauthorised access to a database. (3 marks)
Model answer: The attacker enters malicious SQL code into an input field on a website (1), such as a login form. If the input is not validated/sanitised, the SQL code is executed by the database server (1). This can allow the attacker to bypass authentication, read sensitive data, or modify/delete records (1).
Subscribe to continue reading
Get full access to this lesson and all 10 lessons in this course.