Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Network security 2: identifying and preventing vulnerabilities

Security controls are most useful when you can explain which threat they limit and how they limit it. In this worksheet, you will study all seven prevention methods named in OCR J277.

By the end, you should be able to:

explain penetration testing, anti-malware software and firewalls
explain user access levels and strong passwords
explain encryption and physical security
match controls to threats and vulnerabilities
recognise the limitation of each control
recommend a layered set of controls for a scenario

A strong answer does not stop at “this makes the system secure”. It identifies a mechanism and a result.

1. From vulnerability to control

A vulnerability is a weakness that an attacker could exploit. Examples include weak passwords, excessive user permissions, unprotected network traffic, an unlocked server room or insecure handling of website input.

A security control is a measure that reduces a vulnerability, limits an attack or reduces its impact. No single control stops every threat, so organisations use layered security. Different controls protect different parts of the system and support one another.

Use this structure in written answers:

Name a suitable control.
State what the control does.
Link the mechanism to the named threat or vulnerability.

For example: Encryption converts plaintext into ciphertext using an algorithm and a key. If data is intercepted, an attacker without the key cannot understand it.

2. Finding weaknesses and controlling software or traffic

Penetration testing

Penetration testing is an authorised, simulated attack on a system. Testers use attack methods in a controlled way to find vulnerabilities before a malicious attacker exploits them. The organisation can then fix the weaknesses. Internal testing considers threats from within the organisation; external testing considers attacks from outside it.

Anti-malware software

Anti-malware software scans files, programs, downloads and attachments for malicious software. It can compare files with a regularly updated database of known malware signatures. When malware is detected, it may block, quarantine or delete the file. A signature-based scanner may not recognise a new threat until its definitions are updated.

Firewalls

A firewall monitors incoming and outgoing network traffic. It compares traffic with configured rules, such as permitted sources, destinations or services, and blocks traffic that does not meet those rules. A firewall can reduce unauthorised network access and block some suspicious traffic, but it cannot prevent a user from deliberately giving a password to a convincing fraudster.

Fill in the blanks6 marks

______ uses an ______ to identify weaknesses. ______ can compare files with known ______. A ______ compares incoming and outgoing network traffic with ______.

penetration testing
anti-malware software
firewall
authorised simulated attack
malware signatures
traffic rules

Multiple choice, several answers3 marks

Which three statements correctly distinguish penetration testing, anti-malware software and a firewall? Select all that apply.

APenetration testing finds vulnerabilities through an authorised simulated attack
BA firewall encrypts every stored file so that it cannot be deleted
CPenetration testing permanently blocks all future attacks
DAnti-malware software can quarantine a file that matches a known malicious signature
EA firewall applies rules to incoming and outgoing network traffic

3. Controlling user access

A password checks that a person knows a secret before access is granted. A strong password is long and difficult to predict, and uses a mixture of character types. Systems can also limit repeated failed login attempts. These measures make brute-force guessing harder, although a password can still be stolen through phishing or malware.

User access levels give each user only the permissions needed for their role. One user might have read-only access, another might edit a particular folder, and an administrator might manage accounts. This is the principle of least privilege. If an account is misused, the attacker can reach or alter only the resources allowed to that account. Access levels also reduce accidental changes by legitimate users.

The controls work at different stages. A password helps decide whether a user can sign in. Access levels decide what an authenticated user is allowed to see or change.

Fill in the blanks6 marks

A strong ______ makes a ______ harder by increasing the number of possible combinations. Limiting repeated ______ can further reduce guessing. ______ apply the principle of ______, so a user who only needs to view a file could receive ______ access.

password
brute-force attack
user access levels
least privilege
read-only
failed attempts

4. Protecting data and equipment

Encryption uses an algorithm and a key to convert readable plaintext into ciphertext. A corresponding key is needed to decrypt the data. If encrypted data is intercepted or stolen, the ciphertext should be meaningless to someone without the correct key.

Encryption protects the meaning of data. It does not stop the data from being intercepted, copied or deleted. It also depends on protecting the key.

Physical security prevents unauthorised people from physically reaching devices, storage media or network equipment. Measures include locked rooms and cabinets, keycards, biometric entry, security guards, CCTV and alarms. Physical controls can prevent theft, damage, the connection of unauthorised devices, or direct access to a server.

Choose a measure that fits the physical risk. A locked server room is relevant to a server; it does not stop a remote phishing message.

Multiple choice, several answers2 marks

A criminal captures an encrypted file while it is being sent across a network. Which two statements are accurate? Select both.

AEncryption identifies every item of malware in the file
BWithout the correct key, the ciphertext should not reveal the original data
CEncryption guarantees that the file cannot be copied
DThe file has still been intercepted

Fill in the blanks7 marks

Use ______ to discover exploitable weaknesses through an authorised simulated attack. Use ______ to detect and quarantine known malicious files. Use a ______ to filter network traffic using rules. Use ______ to restrict what an authenticated user can view or change. Use a strong ______ to make account guessing harder. Use ______ so intercepted data cannot be understood without the key. Use ______ to restrict direct access to devices and network equipment.

penetration testing
anti-malware software
firewall
user access levels
password
encryption
physical security

Written answer6 marks

A school is worried about malicious email attachments and unauthorised network connections. Explain how anti-malware software and a firewall could each reduce one of these risks.

Write one mechanism-and-result chain for each control. For anti-malware, include scanning or signatures and an action. For the firewall, include traffic, rules and blocking.

Students type their answer here.

Written answer5 marks

Explain how penetration testing can help an online shop reduce the risk of SQL injection and brute-force attacks.

Start with what makes the test legitimate, then explain what the testers do, what they discover and what the shop does with the findings. Do not claim that the test itself permanently blocks attacks.

Students type their answer here.

Written answer9 marks

Recommend one suitable prevention method for each situation and explain how it reduces the named risk.

A. Payroll data may be captured while travelling between two offices.

B. Students should view a shared policy but must not edit it.

C. An intruder might enter the server room and remove a storage device.

Write three pairs: 'Control, mechanism, result'. Choose from encryption, user access levels and physical security, using each once.

Students type their answer here.

5. Layered security and limitations

A recommendation is stronger when it recognises that controls cover different risks.

A firewall can block disallowed traffic, but it may allow a harmful file within permitted traffic.
Anti-malware software can detect malicious files, but signature detection depends on up-to-date definitions.
A strong password makes guessing harder, but social engineering may persuade a user to reveal it.
User access levels limit what a compromised account can reach, but permissions must be configured correctly.
Encryption protects confidentiality if data is captured, but it does not stop interception or deletion.
Physical security protects equipment from direct access, but it does not stop a remote network attack.
Penetration testing finds weaknesses at the time of the test, but the organisation must fix the findings and test again after systems change.

This is why organisations combine controls rather than searching for one perfect solution.

Written answer8 marks

Stretch challenge: A school is launching a web portal that stores student records. Staff sign in remotely, files are uploaded through the portal, records travel across the Internet, and the database server is kept on site.

Recommend a layered security plan using at least four OCR prevention methods. For each method, explain the relevant threat or vulnerability, how the control works, and one limitation or reason another layer is still needed.

Select controls that cover different parts of the scenario. A strong structure is four mini-paragraphs: 'Risk, control, mechanism, limitation'. Finish by explaining why the controls are stronger together.

Students type their answer here.

Review

Without looking back, choose four prevention methods. For each one, name a suitable threat or vulnerability and explain the control's mechanism. Then check your explanations against the worksheet.

For every OCR prevention method, you should be able to complete both parts:

What may it limit or prevent?
How does its mechanism limit the attack or remove the vulnerability?

Your seven methods are: penetration testing, anti-malware software, firewalls, user access levels, passwords, encryption and physical security.

The most important final check is precision. Replace “it makes the system safer” with a real action such as scans, compares, blocks, quarantines, restricts, encrypts, identifies or prevents physical access.