OCR GCSE Computer Science revision notes
Network security Revision Notes
Study Network security with curriculum-aligned Revision Notes resources, practice links, and exam-focused support.
At a glance
revision notes
Resource type
Topic
Network security
Revision notes
Understanding and Preventing System Vulnerabilities Revision Notes
What are System Vulnerabilities?
System vulnerabilities are weaknesses or flaws in a computer system, network, or software that can be exploited by an attacker to compromise its security. These weaknesses can arise from various sources, including design flaws, implementation errors (bugs in code), configuration mistakes, and human factors. Examples range from open network ports and weak passwords to unpatched software and insecure web application code. Identifying these vulnerabilities is essential for protecting data and maintaining system integrity.
Common Types of Vulnerabilities
Vulnerabilities can manifest in many forms. Software bugs are a major source, leading to issues like buffer overflows or SQL injection flaws. Insecure configurations, such as default passwords or unnecessary open ports, create easy entry points. Weak access controls allow unauthorized users to gain privileges. Outdated software and operating systems often contain known vulnerabilities that have not been patched. Human error, like falling for phishing scams, is also a significant vulnerability vector as it can bypass technical controls.
Methods for Identifying Vulnerabilities
Identifying vulnerabilities typically involves several methods. Vulnerability scanning uses automated tools to search for known weaknesses in systems, applications, and networks. Penetration testing (pen testing) goes a step further, simulating real-world attacks to find exploitable flaws. Regular security audits review configurations, policies, and logs to ensure compliance and identify potential weaknesses. Code reviews examine source code for programming errors that could lead to security gaps. User feedback and incident reports can also highlight unexpected vulnerabilities.
Strategies for Preventing Vulnerabilities
Prevention involves a combination of technical and procedural measures. Regularly updating and patching software closes known security holes. Implementing strong access controls (e.g., multi-factor authentication, principle of least privilege) restricts unauthorized access. Using firewalls and intrusion detection/prevention systems monitors and blocks malicious traffic. Encrypting sensitive data protects it even if accessed. User education and awareness training help users recognise and avoid social engineering attacks. Secure coding practices integrate security into software development from the start. Regular backups aid in recovery from successful attacks.
Understanding Threats to Computer Systems and Networks Revision Notes
Malware and its Varieties
Malware is malicious software designed to disrupt, damage, or gain unauthorised access to a computer system. Viruses attach to legitimate programs and spread when those programs are executed, often infecting other files. Worms are self-replicating programs that spread across networks without human intervention, consuming bandwidth. Spyware collects information about users without their knowledge, often monitoring browsing habits or keystrokes. Adware forces unwanted advertisements onto a user's screen. Rootkits are designed to hide the existence of other malware and provide continuous privileged access to a computer. Ransomware encrypts files and demands payment for their release. Understanding these types is crucial for identifying and combating them.
Social Engineering and Deception
Social engineering relies on psychological manipulation to trick users into performing actions or divulging confidential information. Phishing is a common form, where attackers send fraudulent messages disguised as coming from a reputable source to steal data like login credentials or credit card numbers. Pharming redirects users to fake websites without their knowledge, even if they type the correct URL. Shoulder surfing involves directly observing someone entering sensitive data, like passwords. Pretexting is creating a fabricated scenario to persuade a victim to give up information or access to a system. Effective security awareness training is vital to combat these human-centric threats.
Network and System Vulnerabilities
Beyond malware and social engineering, computer systems and networks face other significant threats. Brute force attacks systematically try every possible password combination until successful. Denial-of-service (DoS) attacks aim to make a service unavailable by overwhelming it with traffic, while distributed denial-of-service (DDoS) attacks use multiple compromised systems to launch the attack. Data interception and theft occur when unauthorised parties access data in transit or at rest. SQL injection is a code injection technique used to attack data-driven applications, allowing attackers to interfere with the queries an application makes to its database. Weak network policies, lack of regular security updates, and human error in configuration or usage also introduce major vulnerabilities.
Mitigating Threats and Best Practices
Mitigating these threats requires a multi-layered approach. Regularly updating software and operating systems patches known vulnerabilities. Using strong, unique passwords and multi-factor authentication significantly reduces the risk of unauthorised access. Firewalls act as a barrier between a trusted internal network and untrusted external networks, filtering traffic. Anti-malware software detects and removes malicious programs. Encryption protects data both in transit and at rest, making it unreadable to unauthorised parties. Regular backups ensure data recovery in case of loss or corruption. Educating users about common attack techniques, such as phishing, is also a critical component of a robust security strategy.
Related topics
Study nearby topics next
Revision hubs