A2.4.3 · Network security
Network countermeasures
Every vulnerability from A2.4.2 has at least one real defence built specifically against it. No single countermeasure covers everything, which is exactly why there are so many of them.
Explainer
Ask most people how to keep a network safe and you'll usually get one or two generic answers, something about antivirus tools, maybe a mention of passwords. Neither answer is wrong, but neither is close to complete either. Real network security is layered: different countermeasures each guard against a different, specific kind of weakness, and a network's actual safety comes from how many of these layers are in place together, not from any single one of them being strong.
A countermeasure is a specific action, tool or policy put in place to reduce or remove a particular vulnerability. Naming one usefully means saying which weakness it's actually defending against, not just that it "helps with security" in general.
Explainer
Thirteen common countermeasures
Click each one to see what it actually does and a real example of it in use.
Worked example
Matching threat to countermeasure
A genuinely useful way to check you understand both A2.4.2 and this statement together: for a given vulnerability, can you name the countermeasure built specifically to defend against it, and say why it actually works?
| Vulnerability (A2.4.2) | Primary countermeasure | Why it actually works |
|---|---|---|
| Weak authentication | Multifactor authentication | Even a guessed or stolen password isn't enough on its own, a second factor (a code, a biometric) is also required. |
| SQL injection | Input validation | Rejects or cleans user input before it's ever used to build a command, so a malicious payload never reaches the database. |
| Man-in-the-middle | Encrypted protocols | Even if the traffic is intercepted, it's unreadable without the key, so eavesdropping alone reveals nothing useful. |
| DDoS | DDoS mitigation tools | Detects the abnormal surge in traffic and filters it out, so legitimate requests can still get through. |
| Phishing | Email filtering + employee training | Filtering catches many disguised messages automatically; training helps catch the ones that get through anyway. |
| Zero-day exploit | Update software (once a patch exists) + IDS/IPS in the meantime | There's no direct fix before a patch exists, so ongoing monitoring is the only real defence until one is released. |
This isn't one-to-one in real life, several countermeasures often overlap on the same vulnerability, and one countermeasure can help against more than one threat (encrypted protocols also help against insecure network protocols, for instance). The table shows the clearest match for each, not the only one.
Explainer
Testing and training
Countermeasures aren't a "set it and forget it" job. Two ongoing practices matter as much as any single tool.
Regular security testing (such as penetration testing, deliberately trying to break into your own system the way an attacker would) checks that existing countermeasures are still actually working, and surfaces new weaknesses before a real attacker finds them first.
Employee training matters because people, not just systems, get targeted. A phishing email is aimed at a person clicking a link, not at a firewall. No technical countermeasure defends against an employee who doesn't recognise a scam message and hands over their password anyway.
Explainer
Wireless security measures
A wireless network has a weakness a wired one doesn't: anyone within radio range can attempt to connect, without ever plugging a cable into anything. One specific measure targets exactly this.
Every network device has a unique MAC (media access control) address built into its network hardware. A network can be configured to check this address before allowing a connection at all, on top of whatever password is also required.
| Approach | How it works |
|---|---|
| Whitelist | Only the specific MAC addresses on the list may connect. Anything not listed is refused automatically, even with the correct password. |
| Blacklist | Every MAC address may connect except the ones specifically listed. Requires knowing in advance which devices to block. |
A determined attacker can fake ("spoof") a MAC address, so this isn't unbreakable on its own, it's one more layer combined with a strong Wi-Fi password, not a replacement for one.
Try it yourself
Defending the login from A2.4.2
The exact vulnerable build_query function from A2.4.2, now defended with input validation: reject any username containing a quote character before it ever reaches the query.
Running in offline fallback mode. The full Python engine couldn't load (blocked school network, or no internet), so this console switched automatically to a small hand-written engine. It supports this page's functions and string handling, but it isn't full Python.
This is deliberately the simplest possible version of input validation, real systems use more thorough techniques, but the principle is identical: check the input BEFORE it's trusted, not after.
Check your understanding
A school wants to stop unauthorized laptops from joining its staff Wi-Fi, even if someone outside the school somehow learns the Wi-Fi password. Which countermeasure specifically addresses this?
Common mistake
RecurringA well-documented, repeated error is confusing a VPN with Wi-Fi, treating "connecting remotely" and "connecting wirelessly" as the same idea. They solve completely different problems.
VPN confused with Wi-Fi: "A VPN lets employees connect to the office network wirelessly from home." Wi-Fi is about the physical connection medium (radio signals instead of a cable). A VPN has nothing to do with that, an employee's home internet connection, wired or wireless, is completely separate from whether a VPN is being used.
What a VPN actually is: "A VPN creates an encrypted tunnel between a device and a private network over the internet, so traffic between them can't be read or altered even though it's travelling over a public, insecure connection." Names the real mechanism (encryption, tunnelling) and the actual problem it solves (secure remote access over an already-existing internet connection), with no mention of Wi-Fi at all, since it isn't relevant to what a VPN does.
Revision questions
Past-paper style. Write an answer, then reveal the marking points and mark yourself.
[2]Describe how multifactor authentication reduces the risk of unauthorized access, even if a password is stolen.
Marking points
评分要点
- Multifactor authentication requires a second factor as well as the password, such as a one-time code or a biometric.
- So even if an attacker has stolen the password, they still cannot log in without also having the second factor, which is held on the user's own device or body.
- 多因素认证在密码之外还要求第二个因素,例如一次性验证码或生物特征。
- 所以即使攻击者盗走了密码,没有第二个因素他们仍然无法登录,而第二个因素在用户自己的设备上或身体上。
[3]Describe the difference between an intrusion detection system (IDS) and an intrusion prevention system (IPS).
Marking points
评分要点
- An intrusion detection system (IDS) monitors traffic for suspicious patterns and raises an alert, but does not stop the traffic itself.
- An intrusion prevention system (IPS) does the same monitoring and also automatically blocks or drops the suspicious traffic, without waiting for a human to respond.
- 入侵检测系统(IDS)监视流量中的可疑模式并发出警报,但本身不阻止流量。
- 入侵防御系统(IPS)做同样的监视,并且还自动阻止或丢弃可疑流量,不必等人来响应。
[4]A company's staff regularly work from cafes and airports using public Wi-Fi. Describe two countermeasures the company should put in place, and explain what specific risk each one addresses.
Marking points
评分要点
- A VPN: staff connect to the company network through an encrypted tunnel, so even on an insecure public Wi-Fi their traffic cannot be read or altered (addresses eavesdropping and man-in-the-middle attacks on the public connection).
- Multifactor authentication: a second factor is required to log in, so a password captured over public Wi-Fi is not enough on its own to access company systems (addresses credential theft).
- (Other valid answers: full-disk encryption for a lost or stolen laptop; a firewall on each device.)
- VPN:员工通过一条加密隧道连接公司网络,所以即使在不安全的公共 Wi-Fi 上,他们的流量也不能被读取或篡改(应对公共连接上的窃听和中间人攻击)。
- 多因素认证:登录需要第二个因素,所以在公共 Wi-Fi 上截获的密码本身不足以访问公司系统(应对凭据被盗)。
- (其他有效答案:为丢失或被盗的笔记本做全盘加密;每台设备上的防火墙。)
Flashcards
Active recall for this statement’s key terms.
Keep this statement’s practice with you
Free account: unlock every revision question and flashcard for A2.4.3, and every other IB CS 2027 statement.