GCSEPaper 1Network securityIdentifying and preventing vulnerabilities
1.4.2

Identifying and preventing vulnerabilities

Pen testing, anti malware, firewalls, access levels, passwords, encryption and physical security.

Learning Objectives

  • 1Explain the purpose of penetration testing
  • 2Describe how anti-malware software, firewalls and encryption work
  • 3Explain the purpose of user access levels, passwords and physical security
  • 4Match an appropriate prevention method to a given threat, and justify why

Penetration testing

Penetration testing means deliberately trying to break into a system, without already knowing usernames, passwords or other normal ways in, to find weaknesses before a real attacker does. Once weaknesses are found, they can be fixed.
Penetration testing is the process of attempting to gain access to a system's resources without prior knowledge of usernames, passwords or other normal means of access. It is carried out deliberately, often by the organisation itself, to test the effectiveness of existing security measures and uncover vulnerabilities before a real attacker can exploit them, so that those weaknesses can then be fixed.
Penetration testing proactively probes a system's defences by attempting unauthorised access using the same techniques a real attacker might use, without being given legitimate credentials. This exposes vulnerabilities under controlled conditions, allowing them to be addressed before they can be exploited maliciously. It mainly tests access to a system, it is not a defence against data already in transit across a network (see data interception).

Anti-malware software

Anti-malware software scans files on a device and compares them to a database of known malware. If it finds malware, it warns the user and can quarantine (isolate) or delete it. It can also stop a suspicious file being downloaded in the first place.
Anti-malware software scans a device's files, comparing them against a database of known malware. If malware is found, the software alerts the user and takes action, such as quarantining or deleting the infected file, or blocking a malicious file from being downloaded in the first place. This limits threats from viruses, trojans and spyware.
Anti-malware software detects malicious files by comparing them to a continually updated database of known malware signatures, then quarantines, removes, or blocks them. It directly limits malware-based threats (viruses, trojans, spyware), but its effectiveness depends on the malware database being kept up to date and does not, on its own, prevent non-malware threats such as social engineering or brute-force attacks.

Firewalls

A firewall checks data (traffic) coming into and going out of a network, and blocks or allows it based on a set of security rules. For example, it might block traffic from a suspicious source. This helps stop unauthorised access and some attacks coming from outside the network.
A firewall monitors incoming and outgoing network traffic, comparing it against a set of security rules, and blocks or allows data based on those rules, for example, blocking traffic from a suspicious IP address or a known malicious source. This helps limit threats like unauthorised access attempts and some denial of service or malware traffic arriving from outside the network. A firewall protects the boundary of a network, it does not protect data once it is already travelling across a network (e.g. it does not stop data interception in transit).
A firewall filters traffic at the boundary of a network by applying a defined rule set, permitting or blocking data based on criteria such as source address or traffic type. This limits unauthorised access and some inbound attack traffic. Note: a firewall does not prevent data interception, since interception targets data already in transit across a network, outside the boundary the firewall monitors, encryption is the relevant prevention method there.
Firewall: filters trafficSafe trafficSuspiciousFIREWALLNetwork✕ blockedAllowed or blocked based on security rules

User access levels

User access levels control what different users are allowed to see or do on a system. For example, in a school, an administrator might have full access, while a student only has limited access. This means if one account is compromised, or a user makes a mistake, the damage is limited to only what that account could access.
User access levels restrict what data and features each type of user can access, based on what they actually need. For example, an administrator may have full access to a system, while a standard user has only limited access. This limits the risk of insider threats and reduces the damage if a lower-level account is compromised or misused, since that account could not access everything on the system.
User access levels apply the principle of restricting each user to only the data/features required for their role, limiting both accidental misuse and the potential damage from a compromised account, since a lower-privilege account being breached exposes far less than a fully-privileged one would.

Passwords

Passwords protect an account so only the person who knows the password can log in. A strong password (long, complex, hard to guess) makes it much harder for an attacker to guess it correctly, including in a brute-force attack.
Passwords restrict access to an account to whoever knows the correct password. A strong password, long, complex and hard to guess, makes unauthorised access far more difficult, including making a brute-force attack take impractically long to succeed, since there are vastly more possible combinations to try.
Passwords are the primary control on account access; their effectiveness against unauthorised access (including brute-force attacks) scales with length and complexity, since these directly increase the number of possible combinations an attacker's software would need to try before guessing correctly.

Encryption

Encryption was covered in 1.3.2: it scrambles data using a key so that, even if it is intercepted, it cannot be read without that key. This is the main defence against data interception and theft, since it protects the data itself, not just access to a system.
Encryption converts data into a scrambled format using a key, so that even if it is intercepted while being transmitted, it cannot be understood without the correct decryption key. Unlike a firewall (which protects a system's boundary), encryption protects the data itself, making it the relevant prevention method against data interception and theft, and also protects data if a device storing it is stolen.
Encryption secures the data itself rather than the system boundary, making it the appropriate defence against data interception in transit, since even successfully intercepted data remains unusable without the decryption key. It also protects data at rest if a physical device is lost or stolen.
Encryption protects the data itselfMeet at 4pmThe original data🔑Scrambled using a key8f3k#2xQ!pSent across the networkIntercepted here: still unreadable🔑Unscrambled using the keyMeet at 4pmReadable againA firewall guards the boundary, encryption guards the data

Physical security

Physical security means physically protecting the hardware itself, using things like locks, keycard entry, alarms, security guards or CCTV. This helps stop theft of equipment or someone physically accessing a system they shouldn't.
Physical security uses physical barriers and controls, such as locks, keycard access, alarms, security guards and CCTV, to protect hardware and data from physical threats. This helps prevent theft of devices, tampering, and unauthorised physical access to systems that other prevention methods (which mainly work over a network) would not stop.
Physical security addresses threats that require physical proximity, theft of hardware, tampering, or direct unauthorised access, which purely digital/network-based prevention methods cannot address. It is a necessary complement to network-focused security, since strong digital defences offer no protection if an attacker can simply walk away with the physical device.

Matching prevention methods to threats

Different prevention methods stop different threats, and it's important to match the right one to the right threat:
  • Penetration testing – finds weaknesses before attackers do (useful against many threats, e.g. SQL injection).
  • Anti-malware software – stops malware (viruses, trojans, spyware).
  • Firewalls – block unauthorised access attempts and suspicious traffic at the network boundary.
  • User access levels – limit damage from misuse or a compromised account.
  • Passwords – protect against brute-force attacks and general unauthorised access.
  • Encryption – protects data in transit, so it stops data interception.
  • Physical security – stops theft or physical tampering with hardware.
A very common exam trap: a firewall does not stop data interception, since that happens to data already travelling across a network. Encryption is needed for that.
Exam questions often give a threat and ask you to choose (and justify) an appropriate prevention method, or vice versa:
Prevention methodMainly limits
Penetration testingFinds vulnerabilities generally (e.g. before SQL injection or brute-force attacks can exploit them)
Anti-malware softwareMalware (viruses, trojans, spyware)
FirewallsUnauthorised access attempts, suspicious traffic at the network boundary
User access levelsInsider misuse, damage from a compromised low-level account
PasswordsBrute-force attacks, general unauthorised access
EncryptionData interception and theft (protects data in transit)
Physical securityTheft or tampering with physical hardware
A firewall does not stop data interception, this is one of the most common mistakes examiners see, data in transit across a network needs encryption, not a firewall.
When matching prevention methods to threats, some questions accept more than one valid method, read the instructions carefully rather than assuming only one answer is expected. The most tested distinction is between methods that protect a system's boundary/access (firewalls, passwords, user access levels, penetration testing) versus methods that protect data itself (encryption) or physical hardware (physical security), a threat should be matched to the category of defence that actually addresses how that threat operates.
Prevention method → mainly limitsPenetration testingfinds vulnerabilities earlyAnti-malware softwareviruses, trojans, spywareFirewallsunauthorised access, boundary trafficUser access levelsinsider misusePasswordsbrute-force attacksEncryptiondata interception (in transit)Physical securitytheft, tamperingA firewall does NOT stop data interception

Exam Phrasing: Use These Exact Phrases

  • ✓Penetration testing attempts to gain access without prior knowledge of login details, to find vulnerabilities before real attackers do
  • ✓Anti-malware software compares files to a database of known malware and quarantines or removes threats
  • ✓A firewall monitors traffic and blocks or allows it based on a set of security rules
  • ✓User access levels restrict users to only the data and features they need
  • ✓A strong, complex password makes brute-force attacks take impractically long to succeed
  • ✓Encryption protects data in transit, so intercepted data cannot be understood without the key
  • ✓Physical security protects hardware from theft, tampering or unauthorised physical access
  • ✓A firewall does not prevent data interception; encryption does
  • 💡Learn the pairing: encryption stops data interception; a firewall does not, examiners specifically flag this as a common misconception.
  • 💡For each prevention method, be ready to explain what it limits and how it limits it, not just name it.
  • 💡If a question asks for more than one appropriate method and provides multiple mark rows/boxes, check whether more than one answer is expected, don't assume only one method applies.
  • 💡A keylogger is a type of spyware, so anti-malware software is the relevant prevention method for it, not a firewall.

Wrong:

Encryption stops data being intercepted

Right:

Encryption does not prevent interception at all: the data can still be intercepted, but without the key it is meaningless to whoever takes it

Why it matters: OCR examiners flagged this in more than one mark scheme. Encryption protects the data once taken, it does not stop the taking.

Wrong:

A firewall prevents data interception

Right:

Encryption prevents data interception; a firewall protects a network's boundary/access

Why it matters: Data interception targets data already travelling across a network, which is outside what a firewall monitors, this is a frequently tested misconception.

Wrong:

Anti-malware software stops all types of threats

Right:

Anti-malware software specifically targets malware (viruses, trojans, spyware), not threats like phishing or brute-force attacks

Why it matters: Different prevention methods target different threats, matching the right one to the right threat is what these questions test.

Wrong:

Only ticking one prevention method when a question allows for more than one correct answer

Right:

Read the question and mark scheme structure carefully, some threats have more than one valid prevention method

Why it matters: OCR examiners noted candidates sometimes missed additional valid answers by only selecting one option per row.

Question:

A company's database is at risk from SQL injection attacks. Recommend a method to help identify this vulnerability before it is exploited, and justify your answer. [2]

💡 Attempt this before revealing the answer, practice makes perfect!

Model Answer:

Penetration testing would be appropriate. This involves deliberately attempting to gain unauthorised access to the system, including trying techniques like SQL injection, without prior knowledge of login details, so that any vulnerabilities can be discovered and fixed before a real attacker exploits them.

Mark Scheme:

  • 1Identifies penetration testing
  • 2Justifies with: deliberately attempts unauthorised access to find/fix vulnerabilities before a real attack happens

Tap a card to flip it. Use the arrow keys to move and space to flip.

Known 0 Still learning 0
1 / 12

Exam-style questions. Have a go, then reveal the mark scheme to check your answer.

1.State the purpose of penetration testing.

[1]

2.Explain how anti-malware software helps protect a system.

[2]

3.Explain why a firewall would not prevent data interception.

[2]

4.A school wants to prevent students from accessing staff-only files. State an appropriate prevention method and explain how it would help.

[2]

5.A company sends sensitive customer data between two offices over the internet. Recommend a method to protect this data if it is intercepted, and explain why the method you have chosen is more appropriate than using a firewall alone.

[3]

6.A website has been targeted by brute-force attacks on its user accounts. Explain how requiring stronger passwords would help limit this threat.

[3]

7.A business keeps its servers in an unlocked room that anyone in the building can walk into. State one physical security measure it could use, and explain what threat this would limit that its firewall and anti-malware software would not.

[3]

8.A school wants to improve its network security. Discuss the methods available and how effective each would be against different threats.

[8]

Extended response · marked in levels, not by counting points

2025Question paperMark schemeExaminers' report
2024Question paperMark schemeExaminers' report
2023Question paperMark schemeExaminers' report
2022Question paperMark schemeExaminers' report

The examiners' reports are the most useful and least read of the three: they say what candidates actually got wrong each year. All files are hosted by OCR.

Past-paper questions grouped by topic

The same OCR questions, sorted by topic rather than by year (via Physics & Maths Tutor).

2023
Paper 1

A common misconception was that a firewall and penetration testing could prevent data interception. Both mainly control access to a system; if data is being transmitted between computers (e.g. over the internet), there is no firewall in place to stop the interception, encryption is the relevant defence.

Paper 1

On a question matching prevention methods to threats, some candidates only selected one method per threat when the question allowed for more than one correct answer, missing marks for valid additional methods.

Previous

Threats to computer systems and networks

Next

Operating systems