EnglandComputer ScienceSyllabus dot point

What threats face a network, and how do firewalls, proxies and encryption defend against them?

Network security: the threats from malware (viruses, worms, trojans), social engineering and network attacks, and the protective measures of firewalls, proxy servers, encryption and access control.

An OCR H446 answer on network security: the threats from malware (viruses, worms, trojans), social engineering such as phishing, and network attacks, together with the protective measures of firewalls, proxy servers, encryption and access control.

Generated by Claude Opus 4.813 min answerUpdated 2026-06-02

Reviewed by: AI editorial process; not yet individually human-reviewed

Have a quick question? Jump to the Q&A page

Quick answer

Networks face threats from malware, from people, and from attacks. Malware includes viruses (attach to a host file and replicate when the user runs it), worms (self-replicate across a network automatically without a host) and trojans (disguised as legitimate software, run a hidden payload but do not replicate). Social engineering manipulates people into giving up access, for example phishing emails. Other threats include SQL injection, denial of service and interception. Protective measures include firewalls (filter traffic against rules to control access), proxy servers (act as an intermediary, hiding internal addresses and filtering or caching requests), encryption (scramble data so an interceptor cannot read it) and access control (passwords, permissions and authentication that limit who can do what). These layers complement one another: firewalls control access while encryption protects the data itself.

Jump to a section

What this dot point is asking
The answer
Examples in context
Try this

What this dot point is asking

OCR wants the main network threats (malware types, social engineering, attacks) and the protective measures (firewalls, proxy servers, encryption, access control), with how each works. Expect a "distinguish virus, worm and trojan" question and a "how do firewalls and encryption protect a network" question.

The answer

Malware

Social engineering and attacks

Protective measures

Key fact

A firewall monitors and filters incoming and outgoing traffic against a set of rules, blocking packets that are not permitted (by port, IP address or protocol), so it controls what can enter or leave the network. A proxy server sits between clients and the wider network, forwarding requests on their behalf; it hides internal IP addresses, can filter content, cache frequently requested resources and log traffic. Encryption scrambles data so that even if intercepted it cannot be read without the key, protecting confidentiality in transit and at rest. Access control limits who can do what through authentication (passwords, biometrics, two-factor) and permissions. Strong input validation defends against SQL injection. These measures are layered: no single one is sufficient, so they are combined (defence in depth).

Choose defences for a school network

A school worries about (a) staff being tricked into revealing passwords, (b) student data being read if intercepted, and (c) unauthorised programs reaching the network from the internet. Recommend a measure for each.

step 1: Tackle the password-tricking threat

Staff being deceived is social engineering (phishing). Technical filters help, but the key defence is staff training to recognise phishing, plus two-factor authentication so a stolen password alone is not enough.

step 2: Protect data if intercepted

Intercepted data is readable only if it is plaintext. Encrypting the data (HTTPS in transit and encrypting stored records) ensures an interceptor cannot read it without the key.

step 3: Block unwanted incoming programs

Unwanted traffic and programs arriving from the internet are blocked by a firewall filtering incoming traffic against rules, supported by anti-malware software and a proxy server filtering web content.

step 4: Summarise as layered defence

Training and two-factor for people, encryption for data, and a firewall (with anti-malware and a proxy) for the boundary, each addressing a different threat, together giving defence in depth.

Examples in context

A company firewall blocks unexpected inbound connections while allowing web and email; a proxy caches popular pages and filters banned sites. HTTPS encrypts traffic so intercepted packets are unreadable. Phishing remains the commonest breach route, which is why training and two-factor authentication matter. SQL injection is defeated by validating and parameterising input. OCR links this to encryption and hashing, to the TCP/IP stack (where defences sit at different layers), and to the legal and privacy module.

Try this

Q1. State how a worm differs from a virus in the way it spreads. [2 marks]

Cue. A worm self-replicates and spreads automatically across a network without a host file or user action; a virus attaches to a host file and needs the user to run it.

Q2. State the purpose of a firewall. [1 mark]

Cue. To monitor and filter incoming and outgoing network traffic against rules, controlling what can enter or leave the network.

Q3. Explain why encryption is used in addition to a firewall. [2 marks]

Cue. A firewall controls access at the boundary but does not protect data once intercepted in transit; encryption keeps the data unreadable without the key, so the two are complementary.

Exam-style practice questions

Practice questions written in the style of OCR exam questions on this dot point, with worked answer explainers. The year tag is the paper they imitate, not the source.

OCR 20196 marksExplain the difference between a virus, a worm and a trojan, giving how each spreads or operates.

Show worked answer →

Award two marks per type for a correct description.

Virus: malicious code that attaches itself to a host file or program and replicates when that file is run or shared by the user; it needs the user to execute the infected file to spread.

Worm: self-replicating malware that spreads automatically across a network by exploiting vulnerabilities, without needing a host file or user action, so it can spread very rapidly and consume bandwidth.

Trojan: malware disguised as legitimate, desirable software that the user installs willingly; it does not self-replicate but, once run, performs a hidden malicious action such as opening a backdoor. Markers reward the host-file/user-action point for a virus, automatic self-spreading for a worm, and disguise without replication for a trojan.

OCR 20216 marksDescribe how a firewall and encryption each contribute to protecting a network, and explain why both are used together.

Show worked answer →

Firewall (up to 3): a firewall monitors and filters incoming and outgoing network traffic against a set of rules, blocking packets that are not permitted (for example by port, IP address or protocol), so it controls what can enter or leave the network and stops unauthorised access.

Encryption (up to 2): encryption scrambles data so that even if it is intercepted it cannot be read without the key, protecting confidentiality in transit and at rest.

Used together (up to 1): a firewall controls access at the boundary but cannot protect data once it is in transit beyond the network; encryption protects the data itself but does not block unauthorised access, so the two are complementary layers of defence. Markers reward the filtering role, the confidentiality role, and the complementary-layers point.

Related dot points

Sources & how we know this

OCR AS and A Level Computer Science (H046, H446) specification — OCR (2015)