📚 IGCSE OCR Computer Science: Network Security Essentials | IGCSE OCR 计算机：网络安全 考点精讲
Network security is a core topic in the IGCSE OCR Computer Science syllabus, covering the threats that can compromise computer systems and the measures used to protect data, networks, and devices. This article breaks down the key points you need to know for your exam, from common attack methods such as malware and social engineering to defensive strategies including encryption, firewalls, and network policies.
网络安全是 IGCSE OCR 计算机科学大纲的核心主题，涵盖可能危害计算机系统的威胁，以及用来保护数据、网络和设备的措施。本文分解考试中需要掌握的关键点，从恶意软件和社会工程学等常见攻击手段，到包括加密、防火墙和网络策略在内的防御策略。
1. The Need for Network Security | 网络安全的必要性
Data transmitted over networks is vulnerable to unauthorised access, interception, modification, and destruction. Without proper security, personal information, financial records, intellectual property, and system integrity can all be compromised. Organisations must protect against both external attackers and internal risks, making network security a fundamental requirement for any connected system.
通过网络传输的数据容易遭受未经授权的访问、截获、篡改和破坏。没有适当的安全措施，个人信息、财务记录、知识产权和系统完整性都可能受到损害。组织必须同时防范外部攻击者和内部风险，这使得网络安全成为任何互联系统的基本要求。
In the context of IGCSE OCR, you need to know why network security matters, the range of threats, and the countermeasures that can be deployed. Questions often ask you to describe threats, suggest prevention methods, or evaluate the effectiveness of different security techniques.
在 IGCSE OCR 的背景下，你需要了解网络安全为何重要、各种威胁类型以及可部署的对策。考题常常要求描述威胁、提出预防方法，或评估不同安全技术的有效性。
2. Types of Network Threat | 网络威胁的类型
Common network threats include malware, phishing, social engineering, brute-force attacks, denial-of-service (DoS) attacks, data interception, and SQL injection. Each threat exploits a different weakness, whether technical, human, or policy-based. Understanding these categories helps you answer scenario-based questions that ask you to identify and explain a specific attack.
常见的网络威胁包括恶意软件、网络钓鱼、社会工程学、暴力破解攻击、拒绝服务攻击、数据截获和 SQL 注入。每种威胁都利用不同的弱点，无论是技术性的、人为的还是策略上的。理解这些类别有助于你回答基于场景的题目，这些题目要求识别并解释特定的攻击。
- Malware – malicious software designed to damage or gain unauthorised access.
- Phishing – fraudulent attempts to obtain sensitive information by pretending to be a trustworthy entity.
- Social engineering – manipulating people into divulging confidential information or performing actions.
- Brute-force attacks – automated trial-and-error to crack passwords or encryption keys.
- DoS attacks – flooding a network or server with traffic to make it unavailable.
- Data interception – eavesdropping on network communication to steal data.
- SQL injection – inserting malicious SQL statements into an input field to manipulate a database.
在列表中，各种威胁被一一列举：恶意软件是旨在造成破坏或未经授权访问的恶意软件；网络钓鱼是通过伪装成可信实体来获取敏感信息的欺诈行为；社会工程学是操纵人们泄露机密信息或执行某些操作；暴力破解攻击是通过自动化试错来破解密码或加密密钥；拒绝服务攻击是通过大量流量使网络或服务器无法使用；数据截获是窃听网络通信以窃取数据；SQL 注入是将恶意 SQL 语句插入输入字段以操纵数据库。
3. Malware in Detail | 恶意软件详解
Malware is a broad term covering viruses, worms, trojans, spyware, adware, and ransomware. A virus attaches itself to legitimate programs and spreads when the program is run. A worm replicates itself across networks without needing a host file. A trojan appears to be a useful application but contains hidden malicious code. Spyware secretly monitors user activity, while ransomware encrypts files and demands payment for the decryption key.
恶意软件是一个广义术语，涵盖病毒、蠕虫、特洛伊木马、间谍软件、广告软件和勒索软件。病毒依附于合法程序，当程序运行时传播。蠕虫无需宿主文件即可在网络中自我复制。特洛伊木马看似有用的应用程序，但包含隐藏的恶意代码。间谍软件秘密监视用户活动，而勒索软件则加密文件并要求支付赎金以获取解密密钥。
Anti-malware software uses signature-based detection (matching known patterns) and heuristic analysis (detecting suspicious behaviour) to identify and remove threats. Regularly updating malware definitions is essential, as new variants appear constantly. In the exam, you may be asked to explain how anti-malware software protects a system or to compare different types of malware.
反恶意软件使用基于特征的检测（匹配已知模式）和启发式分析（检测可疑行为）来识别和清除威胁。定期更新恶意软件定义至关重要，因为新变种不断出现。考试中可能会要求解释反恶意软件如何保护系统，或比较不同类型的恶意软件。
4. Social Engineering and Phishing | 社会工程学与网络钓鱼
Social engineering exploits human psychology rather than technical vulnerabilities. Attackers may pose as IT support staff, use pretexting (inventing a scenario to obtain information), or employ baiting (leaving infected USB drives in public places). The key is that the user is tricked into breaking security procedures willingly.
社会工程学利用的是人类心理而非技术漏洞。攻击者可能伪装成 IT 支持人员，使用借口（编造情境以获取信息），或使用诱饵（在公共场所放置受感染的 U 盘）。关键在于用户被骗，自愿违反安全程序。
Phishing is a form of social engineering typically carried out via email or fake websites. A phishing email might appear to come from a bank, asking the recipient to click a link and enter login details. Spear phishing targets specific individuals using personal information to appear more convincing. Education and awareness training are the most effective defences, as no firewall can stop a user from voluntarily giving away a password.
网络钓鱼是社会工程学的一种形式，通常通过电子邮件或虚假网站实施。钓鱼邮件可能看起来来自银行，要求收件人点击链接并输入登录信息。鱼叉式钓鱼利用个人信息针对特定个人，显得更具说服力。教育和意识培训是最有效的防御措施，因为没有防火墙能阻止用户自愿泄露密码。
5. Brute-force and Denial of Service Attacks | 暴力破解与拒绝服务攻击
A brute-force attack systematically tries every possible combination of characters until the correct password or key is found. The time required increases exponentially with key length; a strong password using a mix of upper and lower case, digits, and symbols can make brute-forcing infeasible. Defences include account lockout policies after a number of failed attempts, CAPTCHA challenges, and rate limiting.
暴力破解攻击系统地尝试所有可能的字符组合，直到找到正确的密码或密钥。所需时间随密钥长度呈指数增长；使用大小写字母、数字和符号混合的强密码可以使暴力破解变得不可行。防御措施包括在若干次失败尝试后锁定账户的策略、验证码挑战和速率限制。
A DoS attack aims to overwhelm a network or server by flooding it with useless traffic, making it unavailable to legitimate users. A distributed DoS (DDoS) attack uses many compromised computers (a botnet) to launch the attack simultaneously, making it harder to block. Firewalls can filter suspicious traffic, and intrusion prevention systems (IPS) can detect and mitigate such attacks, but complete prevention is difficult.
拒绝服务攻击旨在通过用无用的流量淹没网络或服务器，使其无法为合法用户提供服务。分布式拒绝服务（DDoS）攻击使用许多受感染的计算机（僵尸网络）同时发起攻击，使其更难阻挡。防火墙可以过滤可疑流量，入侵防御系统（IPS）可以检测并减轻此类攻击，但完全预防很困难。
6. SQL Injection and Data Interception | SQL 注入与数据截获
SQL injection occurs when an attacker inserts malicious SQL code into a web form input field that is not properly validated. If the application concatenates the input directly into a database query, the attacker can manipulate the query to view, modify, or delete data. For example, entering ' OR '1'='1 in a username field could bypass authentication. Prevention relies on parameterised queries (prepared statements) and rigorous input validation.
SQL 注入发生在攻击者将恶意 SQL 代码插入未被正确验证的网页表单输入字段时。如果应用程序将输入直接拼接到数据库查询中，攻击者就可以操纵查询来查看、修改或删除数据。例如，在用户名字段中输入 ' OR '1'='1 可以绕过身份验证。预防依赖于参数化查询（预准备语句）和严格的输入验证。
Data interception involves eavesdropping on network traffic, often using packet-sniffing software. Unencrypted data transmissions (plaintext) can be read directly. Man-in-the-middle attacks occur when an attacker secretly relays and possibly alters the communication between two parties. Using strong encryption protocols like TLS (Transport Layer Security) is the primary countermeasure. Virtual Private Networks (VPNs) also secure data in transit by creating an encrypted tunnel.
数据截获涉及通过网络流量窃听，通常使用数据包嗅探软件。未加密的数据传输（明文）可以被直接读取。中间人攻击发生在攻击者秘密中继甚至可能篡改双方通信时。使用强大的加密协议如 TLS（传输层安全）是主要的对策。虚拟专用网络（VPN）也通过创建加密隧道来保护传输中的数据。
7. Firewalls and Anti-malware | 防火墙与反恶意软件
A firewall monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks (such as the internet). Firewalls can be hardware appliances, software applications, or a combination of both. They examine packet headers, source and destination addresses, ports, and protocols to decide whether to allow or block traffic.
防火墙根据预定的安全规则监控并控制进出网络的流量。它充当受信任的内部网络与不可信的外部网络（如互联网）之间的屏障。防火墙可以是硬件设备、软件应用程序或两者的组合。它们检查数据包头、源地址和目的地址、端口以及协议，以决定是允许还是阻止流量通过。
Anti-malware software works alongside firewalls to detect, quarantine, and remove malicious code. While firewalls block unauthorised access, anti-malware scans files, emails, and memory for known threats. Effective security relies on a layered approach: firewalls filter traffic at the perimeter, anti-malware protects endpoints, and user education reduces the likelihood of social engineering. Regular updates are critical for both components.
反恶意软件与防火墙协同工作，以检测、隔离和清除恶意代码。防火墙阻止未经授权的访问，而反恶意软件则扫描文件、电子邮件和内存中的已知威胁。有效的安全依赖于分层防御：防火墙在外围过滤流量，反恶意软件保护终端设备，用户教育则降低社会工程学的可能性。定期更新对这两个组件都至关重要。
8. Encryption and Secure Transmission | 加密与安全传输
Encryption converts plaintext into ciphertext using an algorithm and a key, making it unreadable to anyone without the decryption key. Symmetric encryption uses the same key for both encryption and decryption (e.g., AES), while asymmetric encryption uses a pair of keys – a public key for encryption and a private key for decryption (e.g., RSA). Asymmetric encryption is often used to securely exchange a symmetric session key for faster bulk encryption.
加密使用算法和密钥将明文转换为密文，使没有解密密钥的任何人都无法读取。对称加密使用相同的密钥进行加密和解密（例如 AES），而非对称加密使用一对密钥——公钥用于加密，私钥用于解密（例如 RSA）。非对称加密常用于安全交换对称会话密钥，以实现更快速的批量加密。
Secure transmission protocols such as HTTPS combine HTTP with TLS/SSL to provide encrypted communication over the web. The padlock icon in a browser indicates that the TLS handshake has established a secure connection, ensuring confidentiality, integrity, and authentication. In exams, you should be able to explain why encryption protects against data interception and how it underpins everyday secure transactions like online banking.
安全传输协议如 HTTPS 将 HTTP 与 TLS/SSL 结合，以在网络上提供加密通信。浏览器中的挂锁图标表示 TLS 握手已建立了安全连接，确保了机密性、完整性和身份验证。在考试中，你应该能够解释为什么加密可以防止数据截获，以及它如何支撑在线银行等日常安全交易。
| Symmetric (Symmetric) | Asymmetric (Asymmetric) |
|---|---|
| Single shared key (单个共享密钥) | Public/private key pair (公钥/私钥对) |
| Faster (更快) | Slower but more secure for key exchange (较慢，但密钥交换更安全) |
| Key distribution problem (密钥分发问题) | Solves key distribution (解决密钥分发问题) |
9. Authentication and Password Security | 身份验证与密码安全
Authentication verifies the identity of a user or system. The three classic factors are something you know (password, PIN), something you have (smart card, security token), and something you are (biometrics such as fingerprint or retina scan). Two-factor authentication (2FA) combines two of these factors, significantly improving security over a password alone.
身份验证核实用户或系统的身份。三个经典因素是：你知道的东西（密码、PIN）、你拥有的东西（智能卡、安全令牌）和你的生理特征（生物识别，如指纹或视网膜扫描）。双因素认证（2FA）结合其中的两个因素，相比仅凭密码大大提高了安全性。
Strong password policies are a fundamental defence. Passwords should be long, contain a mix of character types, and not be reused across sites. Systems should enforce minimum length, complexity requirements, and regular changes, though excessive requirements can lead to poor user behaviour such as writing passwords down. Salting and hashing stored passwords further protect them in the event of a database breach.
强密码策略是一种基本防御手段。密码应该足够长，包含多种字符类型，且不在不同网站重复使用。系统应强制执行最小长度、复杂性要求和定期更改，但过度的要求可能导致不良用户行为，比如把密码写下来。加盐和哈希存储密码可以在数据库泄露时进一步保护密码。
10. User Access Levels and Network Policies | 用户访问级别与网络策略
User access levels restrict what data and functionality different users can access. An organisation might define tiers such as guest, standard user, power user, and administrator. By assigning permissions appropriately, the risk of accidental or malicious data modification is reduced. The principle of least privilege states that users should only be given the minimum access necessary to perform their job.
用户访问级别限制不同用户可以访问哪些数据和功能。组织可能定义诸如访客、标准用户、高级用户和管理员等层级。通过适当分配权限，可以降低意外或恶意数据修改的风险。最小权限原则指出，只应给予用户完成其工作所需的最低访问权限。
Network policies document the rules and responsibilities governing the use of IT resources. An Acceptable Use Policy (AUP) details what users are and are not allowed to do, covering areas such as personal use, downloading software, and sharing passwords. A disaster recovery policy outlines procedures for restoring services after a major incident. These policies, combined with regular training, establish a security-conscious culture.
网络策略以文件形式记录管理 IT 资源使用的规则和责任。可接受使用政策（AUP）详细说明了允许和禁止用户做的事情，涵盖个人使用、下载软件和分享密码等方面。灾难恢复政策概述了重大事件后恢复服务的程序。这些策略与定期培训相结合，建立起具有安全意识的文化。
11. Penetration Testing and Forensics | 渗透测试与取证
Penetration testing (pen testing) is an authorised simulated attack on a computer system, performed to evaluate its security. Testers use the same tools and techniques as real attackers to identify vulnerabilities before malicious hackers can exploit them. The results guide the organisation in patching weaknesses, reconfiguring firewalls, or improving policies.
渗透测试是一种经授权的、对计算机系统进行的模拟攻击，用于评估其安全性。测试人员使用与真实攻击者相同的工具和技术，在恶意黑客利用之前找出漏洞。结果指导组织修补弱点、重新配置防火墙或改进策略。
Digital forensics involves the collection, preservation, and analysis of digital evidence in a way that is admissible in court. Procedures include creating bit-for-bit copies of storage media, documenting the chain of custody, and using write-blockers to prevent evidence tampering. Forensic investigators can recover deleted files, trace network intrusions, and establish timelines of events. For IGCSE OCR, you need to know that forensics helps identify perpetrators and understand how an attack occurred.
数字取证涉及以法庭可采纳的方式收集、保存和分析数字证据。程序包括创建存储介质的逐位复制、记录保管链以及使用写保护器防止证据被篡改。取证调查员可以恢复已删除的文件、追踪网络入侵并建立事件时间线。对于 IGCSE OCR，你需要知道取证有助于识别肇事者并了解攻击是如何发生的。
12. Staying Safe – Applying Knowledge to Exam Questions | 确保安全——在考题中应用知识
OCR IGCSE exam questions often present a scenario – a school, a business, or an online service – and ask you to recommend security measures with justification. Always link your answer to the specific context: for example, a school may need physical security for computer labs and filtering for inappropriate content, while an e-commerce site must prioritise encryption for payment transactions and 2FA for customer accounts. Use technical vocabulary accurately (e.g., “asymmetric encryption” rather than just “encryption” if the context demands it).
OCR IGCSE 的考题常常给出一个场景——一所学校、一家企业或一项在线服务——并要求你推荐安全措施并给出理由。务必将答案与具体情境联系起来：例如，学校可能需要计算机实验室的物理安全和对不当内容的过滤，而电子商务网站则必须优先考虑支付交易的加密和客户账户的双因素认证。准确使用技术词汇（例如，如果情境需要，使用“非对称加密”而不仅仅是“加密”）。
When evaluating the effectiveness of a security measure, consider its strengths, weaknesses, and potential human factors. A firewall is excellent for blocking unauthorised incoming traffic but cannot stop malware delivered via a phishing email. Encryption protects data in transit but does not prevent a user from revealing their password to a scammer. Showing this depth of understanding will help you reach the highest marks.
在评估安全措施的有效性时，要考虑其优点、弱点和潜在的人为因素。防火墙极擅长阻止未经授权的传入流量，但无法阻止通过钓鱼邮件传播的恶意软件。加密保护传输中的数据，但不能阻止用户向诈骗者透露密码。展示这种深刻的理解将有助于你获得最高分。
Published by TutorHao | IGCSE OCR Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图