📚 Cyber Security | 网络安全
Cyber security involves protecting computer systems, networks, and data from digital attacks, damage, or unauthorised access. In an increasingly connected world, understanding the risks and learning how to defend against them is essential for individuals, businesses, and governments. This revision guide covers key IGCSE topics including malware, phishing, encryption, firewalls, and safe online practices, helping you to identify threats and explain prevention methods confidently.
网络安全是指保护计算机系统、网络和数据免受数字攻击、破坏或未经授权的访问。在一个日益互联的世界里，了解风险并学会如何防御，对于个人、企业和政府来说至关重要。本复习指南涵盖 IGCSE 核心主题，包括恶意软件、网络钓鱼、加密、防火墙以及安全上网实践，帮助你识别威胁并充满信心地解释预防方法。
1. Introduction to Cyber Security | 网络安全简介
Cyber security refers to the practices, technologies, and processes designed to protect devices, networks, and data from attack, damage, or unauthorised access. The goal is to maintain the confidentiality, integrity, and availability of information, often called the CIA triad.
网络安全是指为保护设备、网络和数据免受攻击、破坏或未经授权访问而设计的实践、技术和流程。其目标是保持信息的机密性、完整性和可用性，这通常被称为 CIA 三元组。
Attacks can be carried out by individuals, organised criminal groups, or even state-sponsored hackers. Common motives include financial gain, political activism, and causing disruption. As more services move online, the attack surface expands, making cyber security a critical area of study.
攻击可以由个人、有组织犯罪团伙甚至国家支持的黑客实施。常见动机包括经济利益、政治活动和制造混乱。随着越来越多的服务转向线上，攻击面也在扩大，使网络安全成为一个至关重要的研究领域。
2. Malware: Types and Effects | 恶意软件：类型与影响
Malware is short for 'malicious software'. It is any program or code designed to cause harm to a computer system, steal data, or gain unauthorised control. Different types of malware work in different ways, and it is important to know their characteristics for the exam.
恶意软件是 'malicious software'（恶意软件）的缩写。它指任何旨在对计算机系统造成损害、窃取数据或获取未经授权控制的程序或代码。恶意软件的类型不同，工作方式也不同，了解它们的特点对考试很重要。
| Malware Type | English Description | 中文描述 |
|---|---|---|
| Virus | Attaches itself to legitimate files or programs; spreads when the infected file is opened or run. | 附着在合法文件或程序上；当被感染文件打开或运行时传播。 |
| Worm | A standalone program that replicates itself across networks without human action, often exploiting vulnerabilities. | 独立程序，无需人为操作即可通过网络自我复制，通常利用漏洞。 |
| Trojan | Disguises itself as a useful or interesting program, but carries a hidden malicious payload. | 伪装成有用或有趣的程序，但携带隐藏的恶意载荷。 |
| Ransomware | Encrypts user files and demands a ransom payment, usually in cryptocurrency, to restore access. | 加密用户文件，要求支付赎金（通常为加密货币）以恢复访问。 |
| Spyware | Secretly monitors user activity, collects personal data, and sends it to a third party. | 秘密监控用户活动，收集个人数据并发送给第三方。 |
| Adware | Automatically displays unwanted advertisements, often bundled with free software. | 自动显示不必要的广告，常与免费软件捆绑在一起。 |
Anti-malware programs use signature-based detection, heuristic analysis, and behaviour monitoring to identify and remove malware. Keeping software updated and avoiding suspicious downloads are key defences.
反恶意软件程序使用基于签名的检测、启发式分析和行为监控来识别并移除恶意软件。保持软件更新和避免可疑下载是关键防御措施。
3. Phishing, Pharming and Social Engineering | 网络钓鱼、域名欺诈与社会工程学
Phishing involves sending fraudulent emails or messages that appear to come from a trusted source, such as a bank or a well-known company. The aim is to trick the recipient into revealing sensitive information like usernames, passwords, or credit card details.
网络钓鱼是指发送看似来自可信来源（如银行或知名公司）的欺诈性电子邮件或消息。其目的是诱骗收件人透露敏感信息，如用户名、密码或信用卡信息。
Pharming is a more advanced attack where a user is redirected to a fake website even if they type the correct URL. This can be done by infecting a DNS server or altering the hosts file on a computer. Social engineering exploits human psychology rather than technical weaknesses, using deception and urgency to gain confidential information.
域名欺诈是一种更高级的攻击，即使用户输入了正确的网址，也会被重定向到虚假网站。这可以通过感染 DNS 服务器或修改计算机上的 hosts 文件来实现。社会工程学利用的是人的心理而非技术漏洞，通过欺骗和制造紧迫感来获取机密信息。
To avoid these threats, users should verify the sender's email address, look for 'https' in the URL, and avoid clicking suspicious links. Education and awareness training are the most effective countermeasures.
为避免这些威胁，用户应核实发件人的电子邮件地址，检查网址中的 "https"，并避免点击可疑链接。教育和意识培训是最有效的对策。
4. Brute-Force and Denial-of-Service Attacks | 暴力破解与拒绝服务攻击
A brute-force attack attempts to crack a password or encryption key by systematically trying every possible combination until the correct one is found. The time required depends on the length and complexity of the password. Automated tools can attempt millions of passwords per second.
暴力破解攻击试图通过系统性地尝试每一种可能的组合来破解密码或加密密钥，直到找到正确的为止。所需时间取决于密码的长度和复杂性。自动化工具每秒可尝试数百万个密码。
A denial-of-service (DoS) attack floods a server or network with excessive traffic, preventing legitimate users from accessing the service. When multiple compromised computers (a botnet) are used, it is called a distributed denial-of-service (DDoS) attack. These attacks cause service disruption but do not usually steal data.
拒绝服务 (DoS) 攻击是用过量流量淹没服务器或网络，使合法用户无法访问服务。当使用多台被控制的计算机（僵尸网络）时，则称为分布式拒绝服务 (DDoS) 攻击。这类攻击会造成服务中断，但通常不窃取数据。
Defences include account lockout policies after a few failed attempts, CAPTCHA tests, rate limiting, and using intrusion prevention systems (IPS) against DoS attacks.
防御措施包括在几次失败尝试后锁定账户的策略、验证码测试、速率限制，以及使用入侵防御系统 (IPS) 来抵御 DoS 攻击。
5. Data Interception and SQL Injection | 数据截获与 SQL 注入
Data interception occurs when an attacker captures data travelling across a network. Packet sniffers can read unencrypted traffic, exposing sensitive information. Using encryption, such as HTTPS, prevents eavesdropping by making the data unreadable without the correct key.
数据截获是指攻击者捕获在网络中传输的数据。数据包嗅探器可以读取未加密的流量，从而暴露敏感信息。使用加密（如 HTTPS）可以使数据在没有正确密钥的情况下无法读取，从而防止窃听。
SQL injection is a code injection technique that exploits a vulnerability in a website's input form. The attacker enters malicious SQL code to manipulate the backend database, potentially gaining access to, modifying, or deleting data. Input validation and parameterised queries are used to prevent SQL injection attacks.
SQL 注入是一种代码注入技术，利用网站输入表单中的漏洞。攻击者输入恶意的 SQL 代码来操纵后端数据库，可能获取、修改或删除数据。输入验证和参数化查询被用来防止 SQL 注入攻击。
6. Password Protection and Authentication | 密码保护与身份验证
Strong passwords are a first line of defence against unauthorised access. A good password should be long, contain a mix of upper- and lowercase letters, numbers, and special characters, and not be based on dictionary words or personal information.
强密码是防止未经授权访问的第一道防线。一个好的密码应该足够长，包含大小写字母、数字和特殊字符的组合，并且不要基于字典单词或个人信息。
Two-factor authentication (2FA) adds an extra security layer. Even if a password is stolen, an attacker would also need a second factor, such as a one-time passcode sent to a mobile device or generated by an authenticator app. Biometric authentication uses unique physical characteristics like fingerprints, retina scans, or face recognition for identity verification.
双因素认证 (2FA) 增加了一个额外的安全层。即使密码被窃取，攻击者还需要第二个因素，例如发送到移动设备或由认证器应用生成的一次性验证码。生物特征认证使用独特的身体特征，如指纹、视网膜扫描或面部识别，来进行身份验证。
7. Firewalls and Proxy Servers | 防火墙和代理服务器
A firewall is a hardware or software system that monitors and controls incoming and outgoing network traffic based on a set of security rules. It acts as a barrier between a trusted internal network and untrusted external networks, such as the Internet. Firewalls can block unauthorised access while allowing legitimate communication.
防火墙是一种硬件或软件系统，根据一组安全规则监视和控制进出网络流量。它充当可信内部网络与不可信外部网络（如互联网）之间的屏障。防火墙可以阻止未经授权的访问，同时允许合法通信。
Packet filtering inspects data packets and decides to allow or block them based on source IP address, destination IP address, port numbers, and protocols. Proxy servers act as intermediaries, forwarding requests from clients to external servers and filtering content; they can also hide internal IP addresses, enhancing privacy.
数据包过滤检查数据包，并根据源 IP 地址、目标 IP 地址、端口号和协议决定允许还是阻止。代理服务器充当中介，将客户端的请求转发到外部服务器并过滤内容；它们还可以隐藏内部 IP 地址，提高隐私性。
8. Encryption and Digital Signatures | 加密与数字签名
Encryption transforms readable plaintext into ciphertext using an algorithm and a key. Symmetric encryption uses the same key for both encryption and decryption, which is fast but requires secure key exchange. Asymmetric encryption uses a public key to encrypt and a private key to decrypt, solving the key distribution problem.
加密使用算法和密钥将可读的明文转换为密文。对称加密使用相同的密钥进行加密和解密，速度快但需要安全的密钥交换。非对称加密使用公钥加密、私钥解密，解决了密钥分发问题。
Digital signatures verify the authenticity and integrity of a document. The sender creates a hash of the message and encrypts it with their private key. The recipient decrypts the hash with the sender's public key and compares it to a freshly computed hash; a match proves the document has not been altered.
数字签名用于验证文件的真实性和完整性。发送方创建消息的哈希值，并用其私钥加密。接收方用发送方的公钥解密哈希值，并与新计算的哈希值进行比较；若匹配则证明文件未被篡改。
9. Secure Socket Layer (SSL) and Secure Protocols | 安全套接层 (SSL) 与安全协议
SSL and its successor TLS (Transport Layer Security) are protocols that establish an encrypted link between a web server and a browser. Websites using HTTPS display a padlock icon, indicating the connection is secure. This encryption ensures that data cannot be easily intercepted or tampered with during transmission.
SSL 及其后继者 TLS（传输层安全）是在 Web 服务器和浏览器之间建立加密链接的协议。使用 HTTPS 的网站会显示挂锁图标，表明连接是安全的。这种加密确保了数据在传输过程中不易被截获或篡改。
Other secure protocols include SSH (Secure Shell) for remote login, SFTP (Secure File Transfer Protocol) for file transfers, and WPA3 for Wi-Fi security. Using these protocols helps protect sensitive information and prevents data interception attacks.
其他安全协议包括用于远程登录的 SSH（安全外壳）、用于文件传输的 SFTP（安全文件传输协议）和用于 Wi-Fi 安全的 WPA3。使用这些协议有助于保护敏感信息，防止数据截获攻击。
10. Cyber Security Laws and Ethical Hacking | 网络安全法律与道德黑客
Many countries have introduced cyber security laws to combat hacking, identity theft, and the spread of malware. For example, the UK's Computer Misuse Act makes unauthorised access to computer material a criminal offence. These laws serve as a deterrent and provide a legal framework for prosecuting cyber criminals.
许多国家已经出台了网络安全法律，以打击黑客攻击、身份盗窃和恶意软件传播。例如，英国的《计算机滥用法》将未经授权访问计算机资料定为刑事犯罪。这些法律起到了威慑作用，并为起诉网络犯罪提供了法律框架。
Ethical hacking, or penetration testing, involves authorised professionals simulating cyber attacks to identify vulnerabilities before malicious hackers can exploit them. Organisations employ white-hat hackers to strengthen their security posture. Understanding the difference between legal and illegal hacking is an important ethical consideration in computer science.
道德黑客，或称渗透测试，是指由经授权的专业人员模拟网络攻击，以便在恶意黑客利用之前识别漏洞。组织会雇佣白帽黑客来加强自身的安全防护。理解合法与非法黑客行为的区别，是计算机科学中重要的道德考量。
11. Summary and Top Exam Tips | 总结与考试高分技巧
To succeed in IGCSE cyber security questions, make sure you can define key terms, describe how different attacks work, and explain appropriate prevention methods. Use specific technical vocabulary such as 'packet filtering', 'asymmetric encryption', and 'two-factor authentication' to demonstrate knowledge.
要想在 IGCSE 网络安全部分取得好成绩，务必能定义关键术语，描述不同攻击的工作原理，并解释相应的预防方法。使用 "数据包过滤"、"非对称加密" 和 "双因素认证" 等具体的技术词汇来展示你的知识。
When comparing threats, focus on the method of delivery and the effect on the victim. When asked about prevention, link the defence directly to the threat—for example, firewalls prevent unauthorised network access, and encryption protects data during transmission. Always provide real-world examples where possible, such as using a bank's HTTPS website or enabling 2FA on social media accounts.
在比较威胁时，要关注传递方法和给受害者带来的影响。当回答预防措施时，应将防御措施直接与威胁联系起来——例如，防火墙防止未经授权的网络访问，而加密则保护传输中的数据。在可能的情况下，一定要提供现实世界的例子，例如使用银行的 HTTPS 网站或在社交媒体账户上启用双因素认证。
Practise past paper questions and time yourself to get used to the command words like 'describe', 'explain', and 'evaluate'. Revising in a structured way using these bilingual notes will reinforce both your understanding and your ability to express answers clearly.
练习历年真题并计时，以熟悉诸如 "描述"、"解释" 和 "评估" 等指令词。利用这些双语笔记进行结构化复习，将巩固你的理解，并提高你清晰表达答案的能力。
Published by TutorHao | Cyber Security Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图