📚 Cybersecurity Essentials for IGCSE Computer Science (CIE) | IGCSE计算机：网络安全要点解析
In today's digital world, data is one of the most valuable assets, and protecting it from unauthorised access or damage is a critical concern for individuals and organisations alike. This article breaks down the essential cybersecurity topics from the CIE IGCSE Computer Science syllabus, including common threats, vulnerabilities, and the protective measures used to keep computer systems secure.
在当今数字世界中，数据是最宝贵的资产之一，保护数据免遭未经授权的访问或破坏，对个人和组织而言都是至关重要的问题。本文依据 CIE IGCSE 计算机科学考纲，系统梳理网络安全的核心知识点，包括常见威胁、系统漏洞以及保障计算机系统安全的防护措施。
1. What Is Cybersecurity? | 什么是网络安全？
Cybersecurity refers to the protection of computer systems, networks, and data from unauthorised access, theft, damage, or disruption. It involves a combination of technologies, processes, and practices designed to safeguard information and maintain the confidentiality, integrity, and availability of data — often abbreviated as the CIA triad.
网络安全是指保护计算机系统、网络和数据免受未经授权的访问、窃取、破坏或中断。它综合运用技术、流程和实践手段来保障信息安全，维护数据的机密性（Confidentiality）、完整性（Integrity）和可用性（Availability），即通常所说的 CIA 三要素。
Cyberattacks can target individuals, businesses, or governments, and the consequences can range from financial loss and identity theft to national security threats. Understanding how attacks happen is the first step toward building effective defences.
网络攻击可能针对个人、企业或政府，其后果小到经济损失和身份盗用，大到危及国家安全。理解攻击如何发生，是构建有效防御的第一步。
2. Malware: Viruses, Worms, and Trojans | 恶意软件：病毒、蠕虫和木马
Malware (short for malicious software) is any software intentionally designed to cause damage to a computer system. The most common types expected in the IGCSE syllabus are viruses, worms, and Trojans.
恶意软件（Malware，即恶意软件的缩写）是指任何被故意设计用于破坏计算机系统的软件。IGCSE 考纲中最常见的类型包括病毒、蠕虫和木马。
- Virus: A program that attaches itself to a legitimate file or program and spreads when that file is shared. It requires human action (e.g., opening an infected email attachment) to activate.
- 病毒：一种附着在合法文件或程序上的程序，当该文件被分享时传播。它需要人为操作（例如打开受感染的电子邮件附件）才会激活。
- Worm: A standalone program that replicates itself and spreads across networks automatically, without any human interaction. Worms often consume bandwidth and system resources.
- 蠕虫：一种独立运行的程序，能够自我复制并通过网络自动传播，无需任何人为交互。蠕虫常常消耗带宽和系统资源。
- Trojan: A malicious program disguised as legitimate software. Unlike viruses and worms, Trojans do not self-replicate, but they can create backdoors for hackers to access a system.
- 木马：一种伪装成合法软件的恶意程序。与病毒和蠕虫不同，木马不会自我复制，但它可以创建后门，使黑客得以访问系统。
3. Phishing and Social Engineering | 网络钓鱼与社会工程学
Phishing is a cyberattack method where attackers send fraudulent messages, often via email, pretending to be trusted entities (such as a bank or a well-known website). The goal is to trick victims into revealing sensitive information like usernames, passwords, or credit card numbers.
网络钓鱼是一种网络攻击手段，攻击者发送欺诈性消息（通常通过电子邮件），冒充可信实体（如银行或知名网站），目的是诱骗受害者泄露用户名、密码或信用卡号等敏感信息。
Social engineering is a broader term that relies on manipulating people into breaking normal security procedures. Techniques include pretexting (inventing a scenario), baiting (offering something enticing), and tailgating (following an authorised person into a restricted area).
社会工程学是一个更宽泛的概念，它利用人的心理操纵其违反正常的安全规程。常见手段包括冒充情境（编造一个场景）、诱饵攻击（提供有吸引力的物品）和尾随攻击（跟随授权人员进入受限区域）。
Phishing = Fake trust + Urgent request → Data leak | 网络钓鱼 = 伪造信任 + 紧急请求 → 数据泄露
To protect against phishing, always verify the sender's email address, look for spelling errors and unusual requests, and never click on suspicious links. Organisations can also implement email filters to block malicious messages before they reach users.
要防范网络钓鱼，应始终核实发件人的电子邮件地址，注意拼写错误和异常请求，绝不点击可疑链接。组织还可以部署电子邮件过滤器，在恶意消息到达用户之前将其拦截。
4. Brute-Force Attacks and Password Security | 暴力破解攻击与密码安全
A brute-force attack is a trial-and-error method used to crack passwords, PINs, or encryption keys. The attacker systematically tries every possible combination until the correct one is found. The time required depends on the length and complexity of the password.
暴力破解攻击是一种通过反复试错来破解密码、PIN 码或加密密钥的方法。攻击者系统地尝试所有可能的组合，直到找到正确的那个。所需时间取决于密码的长度和复杂度。
- Strong passwords should be at least 8–12 characters long and include uppercase letters, lowercase letters, digits, and special symbols (e.g., P@ssw0rd!9x).
- 强密码应至少包含 8–12 个字符，并包括大写字母、小写字母、数字和特殊符号（例如 P@ssw0rd!9x）。
- Account lockout policies can limit the number of failed attempts, making brute-force attacks impractical.
- 账户锁定策略可以限制失败尝试的次数，使暴力破解攻击变得不切实际。
- Two-factor authentication (2FA) adds an extra layer of security, requiring a second factor such as a code sent to a mobile phone, in addition to the password.
- 双因素认证（2FA）增加了一道额外的安全屏障，除密码外，还需要第二个验证因素，例如发送到手机上的验证码。
5. Denial of Service (DoS) and Distributed DoS Attacks | 拒绝服务攻击与分布式拒绝服务攻击
A Denial of Service (DoS) attack aims to make a computer system or network resource unavailable to its intended users by overwhelming it with excessive traffic or requests. A Distributed Denial of Service (DDoS) attack is amplified version where multiple compromised computers (a botnet) are used to launch the attack simultaneously from many sources, making it much harder to block.
拒绝服务攻击（DoS）旨在通过过量的流量或请求淹没计算机系统或网络资源，使其无法为合法用户提供服务。分布式拒绝服务攻击（DDoS）是 DoS 的增强版，攻击者利用多台被攻陷的计算机（即“僵尸网络”）同时从多个来源发起攻击，使其极难被阻止。
Attackers flood target → Server resources exhausted → Legitimate users denied service | 攻击者淹没目标 → 服务器资源耗尽 → 合法用户无法访问服务
Protective measures include traffic filtering, using firewalls with rate limiting, and employing load balancers to distribute traffic across multiple servers. For IGCSE, it is important to distinguish between the intent of DoS (to disrupt) and the technique (flooding).
防护措施包括流量过滤、使用带速率限制的防火墙以及使用负载均衡器将流量分配到多台服务器。对 IGCSE 考试而言，重要的是区分 DoS 的意图（破坏服务）与技术手段（流量淹没）。
6. Data Interception and Man-in-the-Middle Attacks | 数据拦截与中间人攻击
Data interception occurs when an attacker captures data as it travels across a network. This is often achieved through packet sniffing or tapping into unsecured Wi-Fi connections. When the attacker not only intercepts but also modifies and relays the communication between two parties, it is called a man-in-the-middle (MITM) attack.
数据拦截是指攻击者在数据通过网络传输时将其截获。这通常通过数据包嗅探或接入不安全的 Wi-Fi 连接来实现。当攻击者不仅截获数据，还修改并转发通信双方之间的信息时，就称为中间人（MITM）攻击。
Encryption is the primary defence against data interception. Even if an attacker captures encrypted data, they cannot read it without the correct decryption key. Secure protocols such as HTTPS (using TLS/SSL) and virtual private networks (VPNs) help protect data in transit.
加密是抵御数据拦截的主要防御手段。即使攻击者截获了加密数据，没有正确的解密密钥也无法读取。HTTPS（使用 TLS/SSL）和虚拟专用网络（VPN）等安全协议有助于保护传输中的数据。
7. SQL Injection and Code Injection | SQL 注入与代码注入
SQL injection is a code injection technique where an attacker inserts malicious SQL statements into an input field (e.g., a login box) to manipulate a database. If successful, the attacker can view, modify, or delete data without authorization.
SQL 注入是一种代码注入技术，攻击者将恶意 SQL 语句插入输入字段（例如登录框），以操控数据库。一旦成功，攻击者就可以在未经授权的情况下查看、修改或删除数据。
Input: ' OR '1'='1 → SELECT * FROM users WHERE name = '' OR '1'='1' | 输入：' OR '1'='1 → 查询语句恒为真，绕过认证
Prevention methods include input validation (allowing only expected characters), parameterised queries (prepared statements), and using least-privilege database accounts so that the application has only the permissions it truly needs.
预防方法包括输入验证（只允许预期的字符）、参数化查询（预编译语句），以及使用最小权限数据库账户，使应用程序只拥有其确实需要的权限。
8. Firewalls | 防火墙
A firewall is a hardware or software device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and an untrusted external network (such as the internet).
防火墙是一种硬件或软件设备，根据预定的安全规则监控和控制进出网络的数据流量。它充当可信内部网络与不可信外部网络（如互联网）之间的屏障。
- Packet filtering: Examines each data packet and allows or blocks it based on source IP, destination IP, port, and protocol.
- 数据包过滤：检查每个数据包，并根据源 IP、目标 IP、端口和协议决定放行或阻止。
- Stateful inspection: Tracks the state of active connections and only allows traffic that matches a known legitimate connection.
- 状态检测：跟踪活动连接的状态，只允许与已知合法连接匹配的流量通过。
- Proxy server: Acts as an intermediary, hiding internal IP addresses and filtering content on behalf of clients.
- 代理服务器：充当中间人，隐藏内部 IP 地址，并代表客户端过滤内容。
9. Encryption and Digital Signatures | 加密与数字签名
Encryption is the process of converting plaintext data into ciphertext using an algorithm and a key, making it unreadable without the corresponding decryption key. There are two main types: symmetric encryption (same key for encryption and decryption) and asymmetric encryption (public and private key pair).
加密是使用算法和密钥将明文数据转换为密文的过程，没有相应的解密密钥就无法读取。加密主要有两种类型：对称加密（加密和解密使用同一把密钥）和非对称加密（使用公钥和私钥对）。
Symmetric example: When Alice and Bob share the same secret key to encrypt and decrypt messages — fast but the key must be securely distributed.
对称加密示例：Alice 和 Bob 使用同一个秘密密钥来加密和解密消息——速度快，但密钥必须安全分发。
Asymmetric example: A public key is widely available to encrypt messages, but only the private key can decrypt them. This solves the key distribution problem but is slower.
非对称加密示例：公钥广泛公开，用于加密消息；但只有对应的私钥才能解密。这解决了密钥分发问题，但速度较慢。
A digital signature uses a private key to sign a message, and the recipient uses the sender's public key to verify authenticity and integrity. Digital signatures provide non-repudiation, ensuring that the sender cannot deny having sent the message.
数字签名使用私钥签署消息，接收方使用发送方的公钥验证消息的真实性和完整性。数字签名提供了不可否认性，确保发送方无法否认其已发送的消息。
10. Access Levels, Backups, and Penetration Testing | 访问级别、备份与渗透测试
Implementing appropriate access levels ensures that users only have permissions necessary for their roles. This principle is called least privilege. Administrators can set read-only, edit, or full-control rights on files and databases, reducing the damage caused by accidental errors or compromised accounts.
设置适当的访问级别可确保用户只拥有其工作角色所必需的权限，这一原则称为“最小权限”。管理员可以为文件和数据库设置只读、编辑或完全控制权限，从而降低意外错误或账户泄露造成的损害。
Regular backups are essential for data recovery after a cyberattack or hardware failure. The 3-2-1 backup rule is a practical guideline: keep at least three copies of data, on two different storage media, with one copy stored offsite.
定期备份对于网络攻击或硬件故障后的数据恢复至关重要。3-2-1 备份规则是一个实用指南：至少保留三份数据副本，存储在两种不同的存储介质上，其中一份存放在异地。
Penetration testing (or "pen testing") is an authorized simulated cyberattack performed by security professionals to identify vulnerabilities before malicious attackers can exploit them. It is a proactive security measure that tests both technical weaknesses and human awareness.
渗透测试（Pen Testing）是由安全专业人员执行的一次经授权的模拟网络攻击，目的是在恶意攻击者利用漏洞之前发现它们。这是一种主动的安全措施，既可以检验技术弱点，也可以检验人员的安全意识。
11. User Behaviour and Security Policies | 用户行为与安全策略
Even with strong technical controls, human error remains one of the weakest links in cybersecurity. Effective security policies should include clear rules about password management, acceptable use of company devices, and reporting procedures for suspicious activity.
即使拥有强大的技术控制，人为失误仍然是网络安全中最薄弱的环节之一。有效的安全策略应包括关于密码管理、公司设备可接受使用范围以及可疑活动上报流程的明确规定。
- Security training: Regular workshops help employees recognise phishing emails, avoid unsafe downloads, and respond correctly to social engineering attempts.
- 安全培训：定期举办培训讲座，帮助员工识别钓鱼邮件、避免不安全下载，并正确应对社会工程学攻击。
- Data classification: Marking data as public, internal, confidential, or restricted helps users handle information with appropriate care.
- 数据分类：将数据标记为公开、内部、机密或受限，有助于用户以适当的谨慎程度处理信息。
- Incident response plan: A documented plan defines who to contact and what steps to take if a security breach occurs, minimising downtime and data loss.
- 应急响应计划：一份成文的计划明确了安全事件发生时应联系谁以及采取哪些步骤，以最大限度地减少停机时间和数据损失。
12. Summary and Exam Tips | 总结与考试建议
To excel in IGCSE Computer Science cybersecurity questions, memorise the key definitions and be able to give one real-world example for each type of attack and each protective measure. Always read the question carefully: if it asks for "a method to prevent hacking," name the specific technique (e.g., firewall, encryption, 2FA) rather than giving a vague answer.
要在 IGCSE 计算机科学网络安全题目中取得高分，请牢记关键定义，并能为每种攻击类型和每种防护措施举出一个真实世界的例子。答题时仔细审题：如果题目问“一种防止黑客入侵的方法”，应写出具体技术（如防火墙、加密、双因素认证），而不是给出笼统的答案。
Practise comparing and contrasting concepts, such as virus vs. worm, DoS vs. DDoS, and symmetric vs. asymmetric encryption. Drawing simple block diagrams can also help you explain firewall placement and encryption workflows clearly in written answers.
练习对比和辨析相关概念，例如病毒与蠕虫、DoS 与 DDoS、对称加密与非对称加密。在书面回答中，绘制简单的框图也有助于清晰地解释防火墙的部署位置和加密流程。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图