A2.4.3 · Network security
Network countermeasures
By the end you can
Describe the defences against those attacks, and match each threat to the countermeasure that deals with it.
For every vulnerability in A2.4.2 there is a way to reduce the risk. A is any step that prevents, detects or limits the damage from an attack. The skill the exam rewards is matching: naming the right defence for the right threat and saying why it works. “Install anti-virus” or “use encryption” for everything is a weak answer.
Technical defences#
- Encrypted protocols and certificates: HTTPS (with an SSL or TLS certificate) encrypts web traffic and proves the server's identity, which defeats eavesdropping and man-in-the-middle attacks. A does the same for all of a remote user's traffic.
- Content security policy (CSP): a setting sent by a website telling the browser which sources may load scripts and other content, which blocks injected scripts (XSS).
- Input validation: checking everything a user types before using it, against SQL injection and XSS. (It is a programming defence, but the syllabus pairs it with these attacks.)
- Intrusion detection () and prevention (): both watch traffic for signs of attack. An IDS is passive and raises an alert; an IPS is active and blocks the traffic, drops packets or closes the connection.
- DDoS mitigation: rate limiting (a maximum number of requests per source per minute), traffic analysis, and cloud services that absorb the flood.
- Email filtering: scans messages for spam, phishing links and malicious attachments, and blocks known bad senders.
- Software updates: applying security patches promptly closes the flaws attackers look for.
- Wireless security: strong encryption (WPA2 or WPA3) for Wi-Fi, and optionally MAC filtering, which allows only listed devices (it helps a little, but MAC addresses can be faked).
Authentication#
Complex password policies demand long passwords (a long passphrase beats a short complicated one) and ban reuse. Better still is : requiring two or more kinds of proof from something you know (a password), something you have (a phone or a security key, or a one-time code from an app) and something you are (a fingerprint or face). A stolen password is then not enough. Newer passkeys replace passwords altogether with a key held on your device and unlocked by your fingerprint, face or PIN.
People and process#
Many attacks, phishing above all, succeed because a person made a choice. Training teaches staff to spot suspicious messages, handle data carefully and report anything odd. Testing checks the defences work: penetration tests (ethical hackers try to break in) and vulnerability scans find the weaknesses first, and a simulated phishing email shows who needs more training. Backups, kept offline or encrypted, mean that even if ransomware gets in, the data can be restored without paying.
Attackers keep guessing a stolen password for a staff account. What stops the password alone being enough?
A thief on café Wi-Fi tries to read what customers send to a shop site.
A flood of requests from thousands of addresses threatens to overwhelm a server.
A search box passes whatever is typed straight into a database query.
Script injected into a page tries to load code from an unknown website.
A published flaw in the web server software is being used against sites that have not installed the fix.
Fake invoices with infected attachments arrive in staff inboxes every day.
Employees keep clicking on links in clever fake messages.
0 of 8 matched
Check yourself
Countermeasures
Quick questions, made fresh every time and marked here. Do a few until they feel easy.
Exam practice
Paper 1-style questions
5 questions · 16 marks
Write your answer as you would in the exam, then show the mark points and tick each one your answer made. These are our own questions in the style of the exam, not past-paper questions.
1.Distinguish between an intrusion detection system (IDS) and an intrusion prevention system (IPS).
[3]Distinguish: Make the differences between two things clear.
2.Explain how multi-factor authentication reduces the risk of an account being taken over.
[3]Explain: Give reasons: say what happens AND why, or how one thing causes another.
3.Describe a countermeasure that mitigates a named vulnerability.
[3]Describe: A detailed account: say what happens, step by step if it is a process.
4.Explain why an organisation should train staff as well as install security software.
[3]Explain: Give reasons: say what happens AND why, or how one thing causes another.
5.Discuss whether using strong encryption alone is enough to keep a network secure.
[4]Discuss: Look at the question from more than one side, weigh the points against each other, and come to a conclusion.
Past papers
Old exam questions on this topic
From HL Paper 1, May 2014 to November 2025. These papers were set on the previous syllabus, so the wording may differ from today's exam, but the topic is the same. Find the questions and markschemes in your school's past-paper pack.
| Paper | Question | Marks | About |
|---|---|---|---|
| May 2025 TZ2 | 10(a) | 6 | Controlling who can use a campus network (same in TZ3) |
| May 2025 TZ2 | 10(b)(ii) | 4 | Measures that protect a campus network (same in TZ3) |
| November 2025 | 11(c) | 4 | Ways to secure a wireless LAN |
| May 2021 | 12(c) | 4 | Wireless encryption on a campus network |
| May 2019 | 14(e) | 2 | One way to secure a wireless network |
| November 2019 | 10(e) | 4 | MAC address filtering weighed up |
| November 2018 | 10(b) | 1 | A security measure for a remote site |
| May 2017 | 8(a) | 3 | How MAC addresses add security |
| November 2017 | 11(c) | 3 | Ways to stop unauthorised access to school data |
| November 2014 | 13(d) | 1 | A security method for sending location data |
In a nutshell
- Defence works in layers; no single countermeasure is enough. Match each threat to the countermeasure that deals with it.
- Technical: encrypted protocols (HTTPS) and VPNs, firewalls, IDS (detects) and IPS (blocks), DDoS rate limiting, email filtering, content security policy, regular updates.
- Authentication: strong password policies, and multi-factor authentication so a password alone is not enough.
- People and process: staff training, testing (penetration tests, simulated phishing), backups, and wireless security (WPA2 or WPA3, MAC filtering).
- Quote the pair in an answer: the threat, the countermeasure, and why the countermeasure stops it.