A2.4.2 · Network security
Network vulnerabilities
By the end you can
Describe the common weaknesses and attacks on a network: malware, phishing, DDoS, man in the middle, SQL injection, XSS, weak passwords and more.
A is a weakness an attacker can use. Some are flaws in software or protocols; some are in how people behave. For each one below, learn what the attacker does, what it causes, and (in A2.4.3) the countermeasure that answers it.
Distributed denial of service (DDoS)#
A attack floods a service with so many requests from so many machines that it cannot answer real users. The machines are usually ordinary people's infected devices (a botnet) that the owner does not know are being used. The result is a site that is slow or offline, for example a shop crashing in a sale. Because the traffic comes from thousands of addresses, blocking one is useless.
Insecure protocols#
Older protocols such as HTTP, FTP and Telnet send everything, including passwords, as plain readable text. Anyone who can see the traffic can read it, and even change it. Logging in to a server by Telnet over a shared network is handing your password to everyone on it.
Man in the middle (MitM)#
In a attack the attacker secretly sits between two parties who think they are talking directly. They can eavesdrop and alter the messages. A classic case is a fake Wi-Fi hotspot in a café: everyone who connects is routed through the attacker's laptop. (It is now also called an on-path attack.)
Malware and phishing#
is software built to damage, disrupt or gain access: viruses, worms, spyware, and ransomware, which encrypts your files and demands payment for the key. is a message that pretends to be from a trusted source (your bank, your school) to trick you into giving a password or card number, or into opening something malicious. It attacks the person, so no technology blocks it completely.
SQL injection and cross-site scripting#
Both attacks exploit programs that trust user input. In the attacker types database commands into a form. If the program glues the text straight into its own query, the database runs it: an input like Robert'); DROP TABLE Students; -- can delete a table. In the attacker gets their own script into a page that other users then load, so it runs in their browsers, where it can steal sessions, deface the page or redirect to a bad site. A site that loads scripts from third parties is inviting this. The cause of both is missing validation. (A3.3 shows queries; the safe habit is to never build SQL by joining strings with user input.)
Unpatched software and weak authentication#
When a company fixes a security flaw it publishes the update, which also tells attackers exactly what to look for: any machine still unpatched is easy prey. And systems with weak authentication (short or reused passwords, passwords stored without hashing and salting, no second factor) give attackers a front door.
Thousands of infected cameras all request the same shop page at once, and the site goes down.
A fake café hotspot passes everything you type to the real site, copying your login on the way.
Typing a quote and a command into a search box makes the site show every customer’s details.
A comment on a forum contains script that runs in other readers’ browsers and steals their session.
The same password is used on twenty sites, and one of them leaks it.
A server missed an update released six months ago, and attackers use the published flaw.
Staff log in to a router over Telnet, and their password crosses the network readable.
An email “from the head teacher” asks staff to click to confirm their payroll details.
0 of 8 matched
Check yourself
Network vulnerabilities
Quick questions, made fresh every time and marked here. Do a few until they feel easy.
Exam practice
Paper 1-style questions
5 questions · 16 marks
Write your answer as you would in the exam, then show the mark points and tick each one your answer made. These are our own questions in the style of the exam, not past-paper questions.
1.Describe a distributed denial of service (DDoS) attack.
[3]Describe: A detailed account: say what happens, step by step if it is a process.
2.Explain how a man-in-the-middle attack can steal data on a public Wi-Fi network.
[3]Explain: Give reasons: say what happens AND why, or how one thing causes another.
3.Explain how an SQL injection attack works and what causes the weakness.
[3]Explain: Give reasons: say what happens AND why, or how one thing causes another.
4.Describe how phishing works and the harm it can cause.
[3]Describe: A detailed account: say what happens, step by step if it is a process.
5.Identify four common vulnerabilities of networks.
[4]Identify: Pick out the answer from the options or the context.
Past papers
Old exam questions on this topic
From HL Paper 1, May 2014 to November 2025. These papers were set on the previous syllabus, so the wording may differ from today's exam, but the topic is the same. Find the questions and markschemes in your school's past-paper pack.
| Paper | Question | Marks | About |
|---|---|---|---|
| May 2025 TZ2 | 10(c) | 3 | Risks such as phishing on a campus network (same in TZ3) |
| May 2018 | 12(e) | 4 | Two wireless threats and how to reduce them |
| November 2015 | 4(c) | 2 | An external threat to a school network |
In a nutshell
- DDoS: many compromised devices flood a target with requests until it cannot serve real users.
- Man in the middle: an attacker secretly sits between two parties, reading or changing what passes. Insecure protocols (HTTP, FTP, Telnet) send data in the clear.
- Malware: malicious software, such as ransomware that encrypts files for payment. Phishing tricks people into handing over details.
- SQL injection puts database commands into an input field because the input was not validated. Cross-site scripting injects script that runs in other users’ browsers.
- Unpatched software and weak authentication are weaknesses in how a system is run, and attackers look for both first.