📚 GCSE CIE Computer Science: Network Security Essentials | GCSE CIE 计算机：网络安全考点精讲
Network security is a vital part of modern computing. Every day, individuals and organisations face threats that can compromise sensitive data, disrupt services, and lead to financial loss. In the CIE GCSE Computer Science syllabus, you need to understand the main types of threats—such as malware, phishing, brute force, and denial-of-service attacks—and the security measures used to counter them. This article breaks down the key knowledge points, pairing English explanations with Chinese translations, so you can revise effectively and succeed in your exams.
网络安全是现代计算中至关重要的一部分。每天，个人和组织都面临着可能泄露敏感数据、中断服务并导致经济损失的威胁。在CIE GCSE计算机科学大纲中，你需要理解主要的威胁类型——如恶意软件、网络钓鱼、暴力破解和拒绝服务攻击——以及用于应对这些威胁的安全措施。本文分解了核心考点，采用英文解释与中文翻译配对的方式，帮助你高效复习并在考试中取得好成绩。
1. Understanding Network Security | 理解网络安全
Network security refers to the policies, practices, and technologies designed to protect computer networks and the data they transmit from unauthorised access, misuse, or attack. The three fundamental goals are confidentiality (keeping information secret), integrity (preventing data from being altered without permission), and availability (ensuring authorised users can access resources when needed).
网络安全是指旨在保护计算机网络及其传输数据免受未经授权访问、滥用或攻击的策略、实践和技术。三个基本目标是机密性（保持信息机密）、完整性（防止数据未经许可被篡改）和可用性（确保授权用户在需要时可以访问资源）。
Threats can come from inside or outside an organisation, and they may be intentional (e.g. hacking) or accidental (e.g. an employee losing a USB drive). A solid understanding of these concepts forms the foundation for selecting appropriate countermeasures.
威胁可能来自组织内部或外部，可能是故意的（如黑客攻击），也可能是意外的（如员工丢失U盘）。理解这些概念是选择适当对抗措施的基础。
2. Malware: Viruses, Worms, Trojans, Spyware and Ransomware | 恶意软件：病毒、蠕虫、木马、间谍软件与勒索软件
Malware (malicious software) is any program designed to harm a computer system or steal information. A virus attaches itself to legitimate files and spreads when those files are shared. It requires a host program to replicate.
恶意软件（恶意程序）是指任何旨在损害计算机系统或窃取信息的程序。病毒附着在合法文件上，并在这些文件被共享时传播。它需要宿主程序来复制。
A worm is similar to a virus but can self‑replicate without needing to attach to a file; it exploits network vulnerabilities to spread automatically across connected devices.
蠕虫类似于病毒，但无需附着文件即可自我复制；它利用网络漏洞在连接的设备之间自动传播。
A Trojan horse (or simply Trojan) disguises itself as useful software to trick users into installing it. Once active, it can create backdoors for attackers, steal data, or download other malware.
特洛伊木马（简称木马）伪装成有用的软件，诱骗用户安装。一旦激活，它可为攻击者创建后门、窃取数据或下载其他恶意软件。
Spyware secretly monitors user activity and collects data such as keystrokes, browsing habits, and login credentials. Ransomware encrypts the victim's files and demands a payment (often in cryptocurrency) to restore access.
间谍软件秘密监视用户活动，收集击键记录、浏览习惯和登录凭据等数据。勒索软件加密受害者的文件，并要求支付赎金（通常以加密货币形式）以恢复访问。
3. Phishing and Social Engineering | 网络钓鱼与社会工程学
Phishing is a technique in which attackers send fraudulent emails or messages that appear to come from trusted sources, such as banks or social media platforms. The goal is to trick recipients into revealing personal information, such as passwords or credit card numbers.
网络钓鱼是一种技术，攻击者发送看似来自银行或社交媒体平台等可信来源的欺诈性电子邮件或消息。目的是诱骗收件人泄露密码或信用卡号等个人信息。
Spear phishing targets specific individuals or organisations with personalised information to increase success rates. Social engineering goes beyond emails; it exploits human psychology by manipulating people into breaking security protocols—for example, a caller pretending to be IT support asking for a password.
鱼叉式网络钓鱼针对特定个人或组织，使用个性化信息以提高成功率。社会工程学超越了电子邮件；它利用人的心理，操纵人们违反安全规程——例如，来电者冒充IT支持人员索要密码。
Common signs of phishing include urgent language, misspelled domain names, and suspicious attachments. Always verify the sender's identity before clicking links.
网络钓鱼的常见迹象包括紧急措辞、拼写错误的域名以及可疑附件。在点击链接前务必核实发件人身份。
4. Brute Force Attacks | 暴力破解攻击
A brute force attack systematically tries every possible combination of characters until the correct password or encryption key is found. Attackers use automated software that can test thousands of guesses per second.
暴力破解攻击系统地尝试所有可能的字符组合，直到猜出正确的密码或加密密钥。攻击者使用可以每秒测试数千次猜测的自动化软件。
The time needed to crack a password depends on its length and complexity. Short, simple passwords can be broken in seconds, while long, complex ones with a mix of uppercase, lowercase, digits, and symbols can take years.
破解密码所需的时间取决于其长度和复杂性。短而简单的密码可能在几秒钟内被破解，而包含大小写字母、数字和符号的长而复杂的密码可能需要数年。
Countermeasures include enforcing strong password policies, implementing account lockout after a set number of failed attempts, and using rate limiting to slow down repeated login requests.
对抗措施包括强制实施强密码策略、在多次登录失败后锁定账户，以及使用速率限制来减缓重复的登录请求。
5. Denial of Service (DoS) and Distributed DoS | 拒绝服务与分布式拒绝服务
A Denial of Service (DoS) attack aims to make a network resource unavailable to its intended users by overwhelming it with excessive traffic or requests. This can cause server crashes or crippled performance.
拒绝服务（DoS）攻击的目标是通过用过量流量或请求淹没网络资源，使其无法为合法用户提供服务。这可能导致服务器崩溃或性能瘫痪。
A Distributed DoS (DDoS) attack amplifies the impact by using many compromised computers (a botnet) to flood the target simultaneously. DDoS attacks are harder to block because traffic comes from thousands of different IP addresses.
分布式拒绝服务（DDoS）攻击通过使用许多被感染的计算机（僵尸网络）同时向目标充溢流量，从而放大影响。DDoS攻击更难阻止，因为流量来自数千个不同的IP地址。
Defences include firewalls configured to filter out suspicious packets, intrusion prevention systems, and services that absorb and scrub attack traffic (such as content delivery networks).
防御措施包括配置防火墙以过滤可疑数据包、入侵防御系统，以及能够吸收并清洗攻击流量的服务（如内容分发网络）。
6. SQL Injection and Code Injection | SQL注入与代码注入
SQL injection is a web application vulnerability where an attacker inserts malicious SQL code into an input field. If the application does not validate the input, the database may execute the injected commands, allowing the attacker to view, modify, or delete data.
SQL注入是一种Web应用漏洞，攻击者将恶意SQL代码插入输入字段。如果应用程序未验证输入，数据库可能执行注入的命令，从而使攻击者能够查看、修改或删除数据。
A classic example is entering ' OR 1=1 -- include parameterised queries (prepared statements), input sanitisation, and using stored procedures.
一个经典的例子是在登录表单中输入 ' OR 1=1 --。这可能绕过身份验证，因为条件1=1始终为真。现代防御措施包括参数化查询（预编译语句）、输入清理，以及使用存储过程。
Other code injection attacks, such as command injection, work similarly by inserting operating system commands. The golden rule is never to trust user input: always validate and sanitise it.
其他代码注入攻击，如命令注入，通过插入操作系统命令以类似方式工作。黄金法则是永远不要信任用户输入：始终验证并清理它。
7. Man-in-the-Middle (MitM) Attacks | 中间人攻击
In a Man-in-the-Middle attack, an attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly talking to each other. This can happen on unsecured Wi‑Fi networks or when an attacker compromises a network router.
在中间人攻击中，攻击者秘密拦截并可能篡改两方之间的通信，而这两方以为他们在直接对话。这种情况可能发生在不安全的Wi‑Fi网络上，或攻击者攻陷了网络路由器时。
Data captured can include login credentials, financial details, or private messages. To protect against MitM, always use encrypted connections (HTTPS, SSL/TLS), and avoid sensitive transactions on public Wi‑Fi unless using a VPN.
被截获的数据可能包括登录凭据、财务细节或私人消息。为了防止中间人攻击，务必使用加密连接（HTTPS、SSL/TLS），并避免在公共Wi‑Fi上进行敏感操作，除非使用VPN。
8. Firewalls and Anti‑Malware Protection | 防火墙与反恶意软件保护
A firewall is a security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, such as the internet.
防火墙是一种安全系统，它根据预设的安全规则监控和控制进出网络的流量。它在受信任的内部网络和不受信任的外部网络（如互联网）之间充当屏障。
Firewalls can be hardware‑based, software‑based, or a combination of both. They filter packets by examining header information like source and destination IP addresses, port numbers, and protocol types.
防火墙可以是基于硬件的、基于软件的，或两者结合。它们通过检查头部信息（如源和目标IP地址、端口号和协议类型）来过滤数据包。
Anti‑malware software detects and removes viruses, worms, spyware, and other malicious code. It uses signature‑based detection (comparing files against a database of known threats) and heuristic analysis (detecting suspicious behaviour). Regular updates are critical because new malware variants appear daily.
反恶意软件检测并删除病毒、蠕虫、间谍软件及其他恶意代码。它使用基于签名的检测（将文件与已知威胁数据库进行比较）和启发式分析（检测可疑行为）。定期更新至关重要，因为每天都有新的恶意软件变种出现。
9. Encryption and SSL/TLS | 加密与SSL/TLS
Encryption scrambles data into ciphertext so that only authorised parties with the decryption key can read it. Symmetric encryption uses the same key for encryption and decryption (e.g. AES). Asymmetric encryption uses a pair of mathematically related keys: a public key for encryption and a private key for decryption (e.g. RSA).
加密将数据打乱成密文，只有拥有解密密钥的授权方才能阅读。对称加密使用相同的密钥进行加密和解密（如AES）。非对称加密使用一对数学上相关的密钥：公钥用于加密，私钥用于解密（如RSA）。
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols that establish an encrypted link between a web server and a browser. Websites using TLS display 'https://' and a padlock icon. During the TLS handshake, the server presents a digital certificate that proves its identity, and a symmetric session key is securely exchanged.
SSL（安全套接层）及其继任者TLS（传输层安全）是在Web服务器和浏览器之间建立加密链接的协议。使用TLS的网站显示“https://”和挂锁图标。在TLS握手期间，服务器出示数字证书以证明其身份，并安全地交换对称会话密钥。
Encryption protects data both in transit (when it is being sent over a network) and at rest (when it is stored). It is essential for securing online banking, e‑commerce, and email.
加密保护传输中（通过网络发送时）和静态中（存储时）的数据。它对于保护网上银行、电子商务和电子邮件至关重要。
10. Authentication: Passwords, Biometrics and Two‑Factor | 身份认证：密码、生物识别与双重认证
Authentication confirms the identity of a user or device before granting access. The most common method is password authentication. A strong password should be at least 12 characters long and include a mix of uppercase letters, lowercase letters, digits, and symbols.
身份认证在授予访问权限前确认用户或设备的身份。最常见的方法是密码认证。强密码应至少包含12个字符，并混合大小写字母、数字和符号。
Biometric authentication uses unique physical characteristics, such as fingerprints, facial recognition, or iris scans. Biometrics are hard to replicate but raise privacy concerns if the data is stolen.
生物识别认证使用独特的身体特征，如指纹、面部识别或虹膜扫描。生物特征难以复制，但如果数据被盗就会引发隐私问题。
Two‑factor authentication (2FA) requires two different types of evidence: something you know (password), something you have (a mobile phone to receive a code), or something you are (fingerprint). This adds a strong extra layer of security.
双重认证（2FA）需要两种不同类型的证据：你知道的东西（密码）、你拥有的东西（接收验证码的手机）或你固有的东西（指纹）。这增添了一层强有力的额外安全防护。
11. Access Control and Audit Trails | 访问控制与审计追踪
Access control determines who can view or use specific resources. It works by assigning different permission levels to users. For example, a student may have read‑only access to a file, while a teacher can read and edit it.
访问控制决定了谁可以查看或使用特定资源。它通过为用户分配不同的权限级别来实现。例如，一个学生可能对文件只有只读权限，而教师可以读写。
The principle of least privilege means that users should be given only the minimum access rights necessary to perform their job. This reduces the risk of accidental or intentional data breaches.
最小权限原则意味着只应赋予用户执行工作所需的最小访问权限。这降低了意外或故意数据泄露的风险。
An audit trail (or log) records user activities over time, including login attempts, file accesses, and changes made. These logs are invaluable for detecting security incidents and investigating breaches after they occur.
审计追踪（或日志）记录用户随时间推移的活动，包括登录尝试、文件访问和所做的更改。这些日志对于检测安全事件以及在事件发生后调查漏洞至关重要。
12. Best Practices for Securing Networks and Data | 保护网络与数据的最佳实践
No single security measure can guarantee complete protection; a layered approach known as defence in depth is essential. Regular software updates patch known vulnerabilities, so always apply operating system and application patches promptly.
没有任何单一的安全措施可以保证万无一失；纵深防御的分层方法至关重要。定期的软件更新会修补已知漏洞，因此务必及时安装操作系统和应用程序的补丁。
Educate users to recognise phishing attempts and avoid downloading attachments from unknown sources. Use strong, unique passwords for each service and consider a password manager. Enable 2FA wherever possible.
教育用户识别网络钓鱼企图，并避免从不明来源下载附件。为每个服务使用强健且唯一的密码，并考虑使用密码管理器。在任何可能的地方启用双重认证。
Encrypt sensitive data both in transit and at rest, and maintain encrypted backups so that you can recover in the event of ransomware. Deploy firewalls and anti‑malware tools, and monitor logs for unusual activity. By combining these strategies, you build a resilient defence against a wide range of cyber threats.
对传输中和静态的敏感数据进行加密，并维护加密备份，以便在遭遇勒索软件时能够恢复数据。部署防火墙和反恶意软件工具，并监控日志以发现异常活动。通过结合这些策略，你就能建立起应对各种网络威胁的稳固防线。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图