📚 IB WJEC Computer Science: Network Security Exam Essentials | IB WJEC 计算机：网络安全 考点精讲
Network security is a cornerstone of modern computing, protecting data and systems from unauthorised access, misuse, and cyber attacks. For IB and WJEC Computer Science candidates, understanding the principles, threats, and countermeasures of network security is essential not only for exam success but also for responsible digital citizenship. This revision guide breaks down every key topic, from encryption to social engineering, in a bilingual format that sharpens both technical knowledge and academic language skills.
网络安全是现代计算的基石，保护数据和系统免遭未经授权的访问、滥用和网络攻击。对于 IB 和 WJEC 计算机科学的考生来说，理解网络安全的原理、威胁及应对措施不仅是考试成功的关键，也是负责任的数字公民素养。本考点精讲以双语形式详细拆解从加密到社会工程学的每一个重点话题，同步提升专业知识与学术语言能力。
1. Introduction to Network Security | 网络安全简介
Network security refers to the policies, practices, and technologies designed to protect the integrity, confidentiality, and availability of data and resources on a network. It encompasses both hardware and software mechanisms that defend against a wide range of internal and external threats.
网络安全是指旨在保护网络上数据和资源的完整性、机密性和可用性的策略、实践和技术。它涵盖防御各种内外威胁的硬件和软件机制。
The three core principles of information security, often called the CIA triad, are Confidentiality, Integrity, and Availability. Confidentiality ensures that data is only accessible to authorised users. Integrity guarantees that data remains accurate and unaltered during storage or transmission. Availability ensures that resources are accessible when needed by legitimate users.
信息安全的三个核心原则通常被称为 CIA 三元组：机密性、完整性和可用性。机密性确保数据仅可由授权用户访问；完整性保证数据在存储或传输过程中保持准确且未被更改；可用性确保资源在合法用户需要时能够访问。
2. Common Cyber Threats | 常见网络威胁
Cyber threats are malicious acts that seek to damage, steal, or disrupt digital assets. The most frequent threats include phishing, malware, denial‑of‑service (DoS) attacks, man‑in‑the‑middle attacks, and SQL injection. Each exploits a specific vulnerability in software, hardware, or human behaviour.
网络威胁是指旨在破坏、窃取或中断数字资产的恶意行为。最常见的威胁包括网络钓鱼、恶意软件、拒绝服务攻击、中间人攻击和 SQL 注入。每种攻击都利用软件、硬件或人类行为中的特定漏洞。
Phishing uses deceptive emails or websites to trick users into revealing sensitive information such as passwords or credit card numbers. DoS attacks flood a server with excessive requests, rendering the service unavailable to legitimate users. A man‑in‑the‑middle attack intercepts communication between two parties without their knowledge, allowing the attacker to eavesdrop or modify data.
网络钓鱼利用欺骗性的电子邮件或网站诱骗用户泄露密码或信用卡号等敏感信息。拒绝服务攻击用过量请求淹没服务器，使合法用户无法使用服务。中间人攻击则是在双方不知情的情况下截获通信，使攻击者能够窃听或篡改数据。
3. Types of Malware | 恶意软件类型
Malware, short for malicious software, is any program designed to infiltrate or damage a computer system. Common types include viruses, worms, trojans, ransomware, spyware, and adware. Each operates differently and poses distinct risks to network security.
恶意软件（malware）是任何旨在入侵或破坏计算机系统的程序的统称。常见类型包括病毒、蠕虫、特洛伊木马、勒索软件、间谍软件和广告软件。每种恶意软件的运作方式不同，对网络安全构成不同的风险。
A virus attaches itself to a legitimate program and spreads when that program is executed. A worm replicates itself across a network without needing a host file. Trojans disguise themselves as genuine software but perform harmful actions in the background. Ransomware encrypts a victim's files and demands payment for the decryption key. Spyware secretly monitors user activity, while adware displays unwanted advertisements and can slow down systems.
病毒附着在合法程序上，并在该程序执行时传播。蠕虫无需宿主文件即可通过网络自我复制。特洛伊木马伪装成正常软件，但在后台执行有害操作。勒索软件加密受害者的文件并要求支付赎金以获取解密密钥。间谍软件秘密监视用户活动，而广告软件显示不必要的广告并可能降低系统速度。
4. Social Engineering Attacks | 社会工程攻击
Social engineering exploits human psychology rather than technical vulnerabilities to gain unauthorised access to systems or information. Attackers manipulate people into breaking security procedures, often through impersonation, pretexting, baiting, or tailgating.
社会工程学利用人类心理而非技术漏洞来获取对系统或信息的未经授权访问。攻击者通过冒充、假托、诱饵或尾随等手段，操控人们违反安全程序。
Pretexting involves creating a fabricated scenario to obtain information from a target, such as pretending to be IT support to ask for a password. Baiting offers something enticing, like a free download, that actually contains malware. Tailgating refers to an unauthorised person physically following an authorised person into a restricted area. Because these attacks bypass technical safeguards, user education and strict policies are the most effective defence.
假托是指编造虚假情境以从目标处获取信息，例如冒充 IT 支持人员索要密码。诱饵攻击提供诱人的物品，如免费下载，实际上包含恶意软件。尾随是指未经授权的人员尾随授权人员进入受限区域。由于这些攻击绕过了技术防护，用户教育和严格的政策是最有效的防御手段。
5. Fundamentals of Cryptography | 密码学基础
Cryptography is the practice of securing communication by transforming plaintext into ciphertext using algorithms and keys. It provides confidentiality, integrity, authentication, and non‑repudiation. The two main types are symmetric encryption, where the same key is used for both encryption and decryption, and asymmetric encryption, which uses a public‑private key pair.
密码学是通过使用算法和密钥将明文转换为密文来保障通信安全的实践。它提供机密性、完整性、身份认证和不可否认性。两种主要类型是对称加密（使用同一密钥进行加密和解密）和非对称加密（使用公钥‑私钥对）。
Symmetric algorithms, such as AES, are fast and suitable for bulk data encryption but require a secure method to share the key. Asymmetric encryption, like RSA, solves the key distribution problem because the public key can be shared openly while the private key remains secret. Hybrid systems combine both: asymmetric encryption securely exchanges a symmetric session key, which then encrypts the actual data.
对称算法（如 AES）速度快，适合批量数据加密，但需要安全的方法共享密钥。非对称加密（如 RSA）解决了密钥分发问题，因为公钥可以公开分享而私钥保密。混合系统将两者结合：非对称加密安全地交换对称会话密钥，然后用该密钥加密实际数据。
6. Firewalls and Intrusion Detection | 防火墙与入侵检测
A firewall is a network security device that monitors and controls incoming and outgoing traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, such as the internet. Firewalls can be hardware‑based, software‑based, or a combination of both.
防火墙是一种网络安全设备，根据预设的安全规则监视和控制进出流量。它充当可信内部网络与不可信外部网络（如互联网）之间的屏障。防火墙可以是基于硬件的、基于软件的或两者的结合。
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) complement firewalls by identifying possible malicious activity. An IDS monitors traffic and alerts administrators when suspicious patterns are detected, while an IPS can also take automatic actions to block the threat. Signature‑based detection matches traffic against known attack patterns, and anomaly‑based detection looks for deviations from normal behaviour.
入侵检测系统（IDS）和入侵防御系统（IPS）通过识别可能的恶意活动来补充防火墙。IDS 监视流量并在检测到可疑模式时向管理员报警，而 IPS 还可以自动采取措施来阻止威胁。基于特征的检测将流量与已知攻击模式进行匹配，基于异常的检测则寻找与正常行为的偏差。
7. Virtual Private Networks (VPNs) | 虚拟专用网络
A Virtual Private Network extends a private network across a public network, enabling users to send and receive data as if their devices were directly connected to the private network. VPNs use encryption and tunnelling protocols to secure data transmission over the internet, preserving confidentiality and integrity.
虚拟专用网络（VPN）将专用网络扩展到公共网络上，使用户能够像直接连接到专用网络一样发送和接收数据。VPN 使用加密和隧道协议来保护互联网上的数据传输，维护机密性和完整性。
Common VPN protocols include IPsec, L2TP, and OpenVPN. A VPN tunnel encapsulates the original data packet inside another packet, encrypting the payload. This prevents eavesdropping on public Wi‑Fi and hides the user's IP address. VPNs are widely used by businesses to allow remote employees secure access to corporate resources and by individuals to safeguard privacy.
常见的 VPN 协议包括 IPsec、L2TP 和 OpenVPN。VPN 隧道将原始数据包封装在另一个数据包中，对有效载荷进行加密。这可以防止在公共 Wi‑Fi 上被窃听，并隐藏用户的 IP 地址。VPN 被企业广泛用于让远程员工安全访问公司资源，也被个人用于保护隐私。
8. Secure Protocols (SSL/TLS, HTTPS) | 安全协议 (SSL/TLS, HTTPS)
Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are cryptographic protocols designed to provide communication security over a computer network. They are most commonly used to protect HTTP traffic, resulting in HTTPS (HTTP Secure), which is indicated by a padlock icon in the browser's address bar.
安全套接字层（SSL）及其后继者传输层安全（TLS）是旨在提供计算机网络通信安全的加密协议。它们最常用于保护 HTTP 流量，形成 HTTPS（安全 HTTP），这体现在浏览器地址栏中的挂锁图标上。
TLS uses a handshake process to establish a secure session. During the handshake, the server presents a digital certificate containing its public key, which the client validates using a trusted Certificate Authority (CA). Once authenticated, a symmetric session key is exchanged and used for data encryption. TLS also provides message integrity checks through Message Authentication Codes (MACs).
TLS 通过握手过程建立安全会话。在握手期间，服务器出示包含其公钥的数字证书，客户端使用受信任的证书颁发机构（CA）验证该证书。身份验证通过后，交换对称会话密钥并用于数据加密。TLS 还通过消息认证码（MAC）提供消息完整性检查。
9. Authentication Methods | 身份验证方法
Authentication is the process of verifying the identity of a user, device, or other entity in a computer system. It is a critical component of access control. Common authentication methods are classified into three factors: something you know (password, PIN), something you have (smart card, security token), and something you are (biometrics).
身份验证是验证计算机系统中用户、设备或其他实体身份的过程，是访问控制的关键组成部分。常见的身份验证方法分为三类因素：你知道的东西（密码、PIN 码）、你拥有的东西（智能卡、安全令牌）和你本身的东西（生物特征）。
Multi‑factor authentication (MFA) combines two or more of these factors to increase security. For example, a banking website might require a password (knowledge factor) and a one‑time code sent to a mobile phone (possession factor). Biometric authentication uses unique physical traits such as fingerprints, retinal patterns, or facial recognition. While biometrics is convenient, it raises privacy concerns because biometric data cannot be changed if compromised.
多因素身份验证（MFA）结合两个或多个因素以提高安全性。例如，银行网站可能要求输入密码（知识因素）和发送到手机的一次性验证码（持有因素）。生物特征认证使用独特的身体特征，如指纹、视网膜图案或面部识别。虽然生物特征方便，但它引发了隐私问题，因为一旦泄露，生物特征数据无法更改。
10. Data Integrity Checks | 数据完整性校验
Data integrity ensures that information remains accurate and consistent throughout its lifecycle. In network security, integrity checks detect accidental or malicious alterations to data. Common techniques include parity bits, checksums, and cryptographic hash functions.
数据完整性确保信息在其生命周期内保持准确和一致。在网络安全中，完整性校验用于检测对数据的意外或恶意篡改。常见技术包括奇偶校验位、校验和以及加密哈希函数。
A hash function, such as SHA‑256, takes an input of any length and produces a fixed‑size hash value. Any change to the input, even a single bit, produces a completely different hash. Comparing the hash of received data with the original hash can verify integrity. Hashes are also used in digital signatures and password storage. One‑way property of cryptographic hashes means it is computationally infeasible to reverse the hash back to the original data.
哈希函数（如 SHA‑256）接受任意长度的输入并产生固定大小的哈希值。对输入的任何更改，哪怕只改变一个比特，都会产生完全不同的哈希。比较接收数据的哈希与原始哈希可以验证完整性。哈希还用于数字签名和密码存储。加密哈希的单向性意味着在计算上将哈希逆推回原始数据是不可行的。
11. Best Practices for Network Security | 网络安全最佳实践
Implementing robust network security requires a layered approach, often referred to as defence in depth. Organisations and individuals should adopt a combination of technical controls, administrative policies, and physical safeguards. Regular risk assessments and security audits are essential to identify and mitigate vulnerabilities.
实施稳健的网络安全需要分层方法，通常称为纵深防御。组织和个人应采用技术控制、管理策略和物理防护相结合的方式。定期的风险评估和安全审计对于识别和减轻漏洞至关重要。
Key best practices include keeping software and firmware up to date with patches, enforcing strong password policies, using network segmentation to limit the spread of attacks, implementing least‑privilege access principles, backing up data regularly, and educating users about phishing and social engineering. Incident response plans should be prepared and tested so that a breach can be contained quickly.
关键最佳实践包括：通过补丁保持软件和固件更新、实施强密码策略、使用网络分段以限制攻击蔓延、执行最小权限访问原则、定期备份数据以及教育用户防范网络钓鱼和社会工程学。应制定并测试事件响应计划，以便在发生泄露时能够迅速遏制影响。
12. Legal and Ethical Considerations | 法律与伦理考虑
Network security does not exist in a legal vacuum. Legislations, such as the Computer Misuse Act in the UK and the General Data Protection Regulation (GDPR) in the EU, set strict requirements for data protection and criminalise unauthorised access to computer systems. IB and WJEC syllabuses expect students to understand the basics of these laws and the ethical implications of security work.
网络安全并非存在于法律真空之中。立法，例如英国的《计算机滥用法》和欧盟的《通用数据保护条例》（GDPR），对数据保护提出了严格要求，并将未经授权访问计算机系统定为刑事犯罪。IB 和 WJEC 教学大纲期望学生理解这些法律的基础知识以及安全工作的伦理影响。
Ethical hacking, also known as penetration testing, is performed with permission to identify vulnerabilities before malicious hackers can exploit them. Professionals are bound by codes of conduct that emphasise responsibility, integrity, and respect for privacy. Students must recognise that possessing hacking tools without authorisation can be illegal, and that the same skills that protect systems can also be misused.
道德黑客，也称为渗透测试，是在获得许可的情况下进行的，旨在在恶意黑客利用漏洞之前发现它们。专业人士受行为准则约束，强调责任、诚信和尊重隐私。学生必须认识到，未经授权持有黑客工具可能是非法的，保护系统的技能同样可能被滥用。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图