IB Computer Science A2.4: Network security
New IB Computer Science syllabus · first exams May 2027 · Theme A · SL & HL (A2.4.2 and A2.4.3 HL only)
A2.4 covers how networks are attacked and defended: firewalls, the most common vulnerabilities and their countermeasures, and how encryption and digital certificates keep data safe.
| Statement | Topic | Command term |
|---|---|---|
| A2.4.1 | Effectiveness of firewalls | Discuss |
| A2.4.2 (HL) | Common network vulnerabilities | Describe |
| A2.4.3 (HL) | Common network countermeasures | Describe |
| A2.4.4 | Encryption and digital certificates | Describe |
⚠️ Command term alert: A2.4.1 uses Discuss. Give a balanced view of strengths and limitations, then reach a conclusion about how effective firewalls are.
Key points
A2.4.1 Firewalls
A firewall filters incoming and outgoing traffic using whitelists (only approved traffic is allowed), blacklists (known threats are blocked) and rules (for example "allow TCP port 443; block Telnet").
- Strengths:
- blocks unauthorised access by IP address, port and protocol
- applies the same rules across the whole network
- logs traffic
- NAT hides internal IP addresses
- Limitations:
- can't see inside encrypted traffic
- doesn't stop insider threats, phishing or social engineering
- misconfigured rules give a false sense of security
- zero-day attacks can get past it
- Conclusion: an essential first line of defence, but only effective alongside other measures.
A2.4.2 Vulnerabilities (HL only)
Each vulnerability threatens confidentiality (C), integrity (I) or availability (A):
| Vulnerability | What it does | Threatens |
|---|---|---|
| DDoS | A botnet floods a server with requests | A |
| Insecure protocols | HTTP, Telnet or FTP send data as readable text | C |
| Malware | Viruses, worms, trojans, ransomware, spyware | C, I, A |
| Man-in-the-middle | An attacker intercepts and alters communication | C, I |
| Phishing | Fake messages trick users into giving away credentials | C |
| SQL injection | Malicious SQL typed into an input field, for example ' OR '1'='1'-- | C, I |
| Cross-site scripting (XSS) | Malicious scripts injected into web pages | C, I |
| Unpatched software | Known flaws that haven't been fixed | C, I, A |
| Weak authentication | Weak or reused passwords, no MFA | C |
| Zero-day | A flaw nobody has patched yet | C, I, A |
A2.4.3 Countermeasures (HL only)
- Content security policies: defend against cross-site scripting.
- Strong password policies and multi-factor authentication (MFA): defend against weak authentication and phishing.
- DDoS mitigation services: keep sites available during an attack.
- Email filtering: stops phishing and malware.
- Encrypted protocols (HTTPS, SFTP, SSH): defend against man-in-the-middle attacks.
- Input validation: stops SQL injection and cross-site scripting.
- Intrusion detection and prevention systems (IDS/IPS): spot and block suspicious traffic.
- SSL/TLS certificates and VPNs: encrypt data in transit.
- Patch management: fixes known flaws.
- MAC filtering: controls which devices can join a wireless network. MAC addresses can be faked, so combine it with WPA3.
- Regular security testing and staff training.
A2.4.4 Encryption and digital certificates
- Symmetric encryption: one shared key (for example AES). It's fast, but the key has to be shared securely.
- Asymmetric encryption: a public key encrypts and only the matching private key decrypts (for example RSA). It solves the key-sharing problem, but it's slow.
- How HTTPS uses both: asymmetric encryption during the TLS handshake to exchange a symmetric session key, which then encrypts the data quickly.
- Digital certificates: issued and signed by a trusted certificate authority. A certificate contains the server's public key, its domain, the CA's signature and an expiry date. Browsers check it to confirm the server is genuine.
- Key management: generating, storing, rotating and revoking keys securely. Even strong encryption fails if keys aren't looked after.
Exam-style question
Discuss the effectiveness of firewalls at protecting a network. Your answer should include both strengths and limitations. [6]
Mark scheme
- Strengths [2], for example: filters traffic by port, IP address or protocol; uses whitelists and blacklists; logs traffic; NAT hides internal addresses.
- Limitations [2], for example: cannot inspect encrypted traffic; won't stop insider threats or social engineering; zero-day exploits get past the rules.
- Conclusion [2]: firewalls are an essential first line of defence, but must be combined with other measures (such as an IDS, MFA and encryption) for full protection.
Common mistakes that cost marks
- Answering "Discuss" with only strengths. A one-sided answer can't reach the top marks.
- Mixing up which key does what. The public key encrypts and the private key decrypts. For signatures, the private key signs and the public key verifies.
- Describing an attack without its countermeasure when the question asks for both.
Frequently asked questions
Which parts of A2.4 are HL only?
A2.4.2 (vulnerabilities) and A2.4.3 (countermeasures). Firewalls (A2.4.1) and encryption and digital certificates (A2.4.4) are SL and HL.
Why does HTTPS use both symmetric and asymmetric encryption?
Asymmetric encryption securely exchanges a session key; the faster symmetric encryption then protects the data itself.
Go further
- Practise A2.4 with instant marking on ExamHaus. → examhaus.com
- Full A2.4 presentation and question bank with mark scheme on CS Exam Ready. → csexamready.com/resources/ib-diploma
- IB CS mock exams: Paper 1 & 2, SL & HL. → examhaus.com/mock-exams