📚 Cybersecurity Essentials for IB & OCR Computer Science | IB与OCR计算机科学：网络安全考点精讲
Cybersecurity is the practice of protecting systems, networks, and data from digital attacks, damage, or unauthorised access. For IB and OCR Computer Science students, understanding the full spectrum of threats, defence mechanisms, and cryptographic principles is essential to both exam success and safe computing practices. This guide breaks down the core concepts, from malware and social engineering to encryption and digital certificates, providing bilingual explanations to reinforce your revision.
网络安全是保护系统、网络和数据免受数字攻击、损害或未经授权访问的实践。对于IB和OCR计算机科学学生来说，深入理解威胁全貌、防御机制以及密码学原理，对于考试成功和安全计算习惯都是必不可少的。本指南将核心概念逐一分解，从恶意软件和社会工程学到加密和数字证书，提供中英双语解释以巩固你的复习。
1. Malware: Viruses, Worms, Trojans, Ransomware, and Spyware | 恶意软件：病毒、蠕虫、特洛伊木马、勒索软件和间谍软件
Malware, short for malicious software, is any program designed to infiltrate or damage a computer system without the owner's consent. Common types include viruses, worms, Trojan horses, ransomware, and spyware. A virus attaches itself to a legitimate file and requires user action to spread, whereas a worm self-replicates across networks without human intervention. A Trojan horse disguises itself as useful software but carries a malicious payload. Ransomware encrypts the victim's files and demands payment for the decryption key. Spyware secretly monitors user activity and transmits data to a third party.
恶意软件（malware）是任何旨在未经所有者同意而渗透或破坏计算机系统的程序。常见类型包括病毒、蠕虫、特洛伊木马、勒索软件和间谍软件。病毒将自身附着于合法文件，需要用户动作才能传播；而蠕虫无需人工干预即可在网络上自我复制。特洛伊木马伪装成有用的软件，但携带恶意载荷。勒索软件加密受害者的文件，并要求支付赎金以获取解密密钥。间谍软件秘密监控用户活动，并将数据传输给第三方。
2. Network Attacks: Packet Sniffing, DoS/DDoS, and Man-in-the-Middle | 网络攻击：数据包嗅探、拒绝服务攻击和中间人攻击
Beyond malware, attackers exploit network vulnerabilities. Packet sniffing involves capturing data packets as they travel across a network, often using tools like Wireshark. Unencrypted traffic can reveal sensitive information such as passwords. A Denial-of-Service (DoS) attack floods a server with excessive requests, making it unavailable to legitimate users; in a Distributed DoS (DDoS), multiple compromised systems launch the attack simultaneously. A Man-in-the-Middle (MitM) attack intercepts communication between two parties, allowing the attacker to eavesdrop or alter the data in transit.
除了恶意软件，攻击者还会利用网络漏洞。数据包嗅探（packet sniffing）指捕获流经网络的数据包，常用Wireshark等工具。未加密的流量可能泄露密码等敏感信息。拒绝服务（DoS）攻击用过量请求淹没服务器，使其无法为合法用户服务；在分布式拒绝服务（DDoS）中，多个被攻陷的系统同时发起攻击。中间人（MitM）攻击拦截双方通信，允许攻击者窃听或篡改传输中的数据。
3. Social Engineering: Phishing, Pretexting, and Baiting | 社会工程学：网络钓鱼、假托和引诱
Social engineering manipulates human psychology rather than exploiting technical flaws. Phishing uses deceptive emails or websites that appear legitimate to trick users into revealing credentials. Spear phishing targets specific individuals. Pretexting invents a scenario to obtain personal information, such as calling and posing as bank staff. Baiting tempts victims with a desirable item, like a free music download, to install malware. These attacks highlight that the weakest link in security is often the human element.
社会工程学利用人类心理而非技术缺陷。网络钓鱼（phishing）使用看似合法的欺骗性电子邮件或网站，诱骗用户泄露凭证。鱼叉式网络钓鱼（spear phishing）针对特定个人。假托（pretexting）编造场景以获取个人信息，例如冒充银行工作人员致电。引诱（baiting）用诱人的事物（如免费音乐下载）引诱受害者安装恶意软件。这些攻击凸显出安全中最薄弱的环节往往是人的因素。
4. Firewalls and Network Security Devices | 防火墙与网络安全设备
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules. Packet-filtering firewalls inspect packet headers and block traffic based on IP addresses, ports, and protocols. Stateful inspection firewalls track active connections and make decisions in context. Proxy firewalls act as intermediaries, inspecting application-layer data. Next-generation firewalls (NGFWs) combine traditional functions with intrusion prevention and deep packet inspection. They form the first line of defence in a perimeter security model.
防火墙是一种网络安全系统，它根据预设的安全规则监控和控制进出的流量。包过滤防火墙检查数据包头部，并根据IP地址、端口和协议阻止流量。状态检测防火墙跟踪活动连接，结合上下文做出决策。代理防火墙作为中间人，检查应用层数据。下一代防火墙（NGFW）结合传统功能与入侵防御和深度包检测。它们构成了边界安全模型中的第一道防线。
5. Encryption: Symmetric vs. Asymmetric | 加密：对称与非对称
Encryption transforms plaintext into ciphertext to protect confidentiality. Symmetric encryption uses a single shared key for both encryption and decryption. It is fast and suitable for bulk data, but key distribution is a challenge. Examples include AES (Advanced Encryption Standard) with key sizes of 128, 192, or 256 bits. Asymmetric encryption, or public-key cryptography, uses a key pair: a public key for encryption and a private key for decryption. RSA and ECC are common algorithms. Asymmetric encryption solves the key exchange problem but is computationally heavier.
加密将明文转换为密文以保护机密性。对称加密使用单一共享密钥进行加密和解密。它速度快，适合处理大量数据，但密钥分发是一个挑战。例子包括AES（高级加密标准），密钥大小有128、192或256位。非对称加密，即公钥密码体制，使用密钥对：公钥用于加密，私钥用于解密。常见算法有RSA和ECC。非对称加密解决了密钥交换问题，但计算成本更高。
| Feature (特性) | Symmetric (对称) | Asymmetric (非对称) |
|---|---|---|
| Number of keys (密钥数量) | One shared key (一个共享密钥) | Two keys: public + private (两个密钥：公钥+私钥) |
| Speed (速度) | Fast (快) | Slower (较慢) |
| Key distribution problem (密钥分发问题) | Yes, must share key securely (是，须安全共享) | No, public key can be openly shared (否，公钥可公开) |
| Common algorithms (常见算法) | AES, DES, 3DES | RSA, ECC, ElGamal |
| Typical key length (典型密钥长度) | 128–256 bits (128–256位) | 2048–4096 bits (2048–4096位) |
6. Public Key Infrastructure and Digital Certificates | 公钥基础设施与数字证书
Public Key Infrastructure (PKI) is a framework that manages digital certificates and public-key encryption. A digital certificate binds a public key to an entity (a person, server, or organisation) and is issued by a trusted Certificate Authority (CA). The CA verifies the identity before issuing the certificate. Certificates contain the owner's public key, the CA's digital signature, validity period, and other metadata. When a browser connects to a website using HTTPS, it validates the site's certificate to establish trust. PKI underpins secure email, code signing, and VPN authentication.
公钥基础设施（PKI）是管理数字证书和公钥加密的框架。数字证书将公钥绑定到一个实体（个人、服务器或组织），由受信任的证书颁发机构（CA）签发。CA在颁发证书前验证身份。证书包含所有者的公钥、CA的数字签名、有效期和其他元数据。当浏览器使用HTTPS连接到网站时，它会验证站点证书以建立信任。PKI支撑着安全电子邮件、代码签名和VPN认证。
7. Authentication Methods: Passwords, Biometrics, and Multi-Factor Authentication | 认证方法：密码、生物识别和多因素认证
Authentication verifies the identity of a user or system. Something you know includes passwords and PINs; they are common but vulnerable to brute-force and dictionary attacks. Something you have includes a security token or smart card. Something you are involves biometrics such as fingerprint, iris scan, or facial recognition. Biometrics are harder to replicate but raise privacy concerns. Multi-factor authentication (MFA) combines two or more of these factors, significantly raising the security bar. For example, an online banking login may require a password (something you know) and a one-time code from a mobile app (something you have).
认证用于验证用户或系统的身份。你知道的因素（something you know）包括密码和PIN码；它们常见但容易受到暴力破解和字典攻击。你拥有的因素（something you have）包括安全令牌或智能卡。你是什么的因素（something you are）涉及生物识别，如指纹、虹膜扫描或面部识别。生物识别更难以复制，但引发隐私问题。多因素认证（MFA）结合了其中两个或多个因素，显著提高了安全性。例如，网银登录可能要求密码（你知道的）和手机应用生成的一次性验证码（你拥有的）。
8. SSL/TLS: Secure Sockets Layer / Transport Layer Security | 安全套接层/传输层安全协议
SSL and its successor TLS are cryptographic protocols that provide secure communication over a network. They are the backbone of HTTPS. The protocol uses asymmetric encryption during the initial handshake to exchange a symmetric session key safely. This session key then encrypts the bulk data. The handshake involves the client and server agreeing on cipher suites, the server presenting its certificate, and both parties generating shared secret material. TLS also ensures data integrity via Message Authentication Codes (MACs). Modern web requires TLS 1.2 or 1.3.
SSL及其后继者TLS是在网络上提供安全通信的密码协议。它们是HTTPS的基石。该协议在初始握手期间使用非对称加密安全地交换对称会话密钥，随后用该会话密钥加密大量数据。握手过程包括客户端和服务器协商密码套件、服务器出示其证书，以及双方生成共享秘密材料。TLS还通过消息认证码（MAC）确保数据完整性。现代网络要求使用TLS 1.2或1.3。
9. Malware Protection: Antivirus, Anti-spyware, and Software Patches | 恶意软件防护：防病毒、反间谍软件与补丁
Antivirus software detects and removes malicious code using signature-based detection, heuristic analysis, and behaviour monitoring. Signature-based detection compares files against a database of known malware patterns, requiring frequent updates. Heuristics look for suspicious characteristics, while behaviour monitoring blocks novel threats based on their actions. Anti-spyware tools specifically target spyware and adware. Regular software updates and patches fix security vulnerabilities that malware exploits. Zero-day vulnerabilities are flaws unknown to the vendor; prompt patching is critical. Defence in depth combines these tools with firewalls and user education.
防病毒软件通过基于签名的检测、启发式分析和行为监控来检测和清除恶意代码。基于签名的检测将文件与已知恶意软件模式数据库比对，需频繁更新。启发式分析寻找可疑特征，行为监控根据操作阻止新型威胁。反间谍软件工具专门针对间谍软件和广告软件。定期的软件更新和补丁可修复恶意软件利用的安全漏洞。零日漏洞是供应商未知的缺陷；及时修补至关重要。纵深防御将这些工具与防火墙和用户教育结合使用。
10. Network Security Policies and Acceptable Use | 网络安全策略与可接受使用
Organisations implement security policies to govern how resources are accessed and protected. An Acceptable Use Policy (AUP) defines what users can and cannot do, such as banning file-sharing services or requiring strong passwords. A password policy enforces complexity, length, and expiration rules. Access control policies define who can access certain data, often based on the principle of least privilege. Disaster recovery plans and incident response procedures ensure business continuity after a breach. Regular audits and penetration testing help maintain a robust security posture.
组织通过实施安全策略来管理资源的访问和保护。可接受使用策略（AUP）定义用户可以和不能做什么，例如禁止使用文件共享服务或要求强密码。密码策略强制规定复杂度、长度和过期规则。访问控制策略定义谁可以访问某些数据，通常基于最小权限原则。灾难恢复计划和事件响应程序确保在违规后业务连续性。定期审计和渗透测试有助于保持稳健的安全态势。
11. Data Integrity and Hashing | 数据完整性与哈希
Data integrity ensures that information has not been altered in transit or storage. Hash functions produce a fixed-size digest from input data; even a single-bit change yields a completely different hash. Common algorithms include MD5 (now broken), SHA-1 (deprecated), SHA-256, and SHA-3. Hashes are used to verify downloaded files, store passwords securely (with salting), and build digital signatures. A good cryptographic hash function is collision-resistant, preimage-resistant, and deterministic. Salting adds random data to passwords before hashing to defeat rainbow table attacks.
数据完整性确保信息在传输或存储中未被更改。散列函数根据输入数据生成固定大小的摘要；即使单个比特的改变也会产生完全不同的散列值。常见算法包括MD5（现已破解）、SHA-1（已弃用）、SHA-256和SHA-3。散列用于验证下载文件、安全存储密码（加盐）以及构建数字签名。一个良好的密码散列函数具有抗碰撞性、抗原像性和确定性。加盐在散列之前向密码添加随机数据，以防御彩虹表攻击。
12. Ethical and Legal Considerations in Cybersecurity | 网络安全中的伦理与法律考量
Cybersecurity operates within a framework of laws and ethical standards. Unauthorised access, malware distribution, and data breaches may violate the Computer Misuse Act (UK) or similar legislation in other jurisdictions. The General Data Protection Regulation (GDPR) mandates stringent data protection for EU citizens. Ethical hackers, or penetration testers, must operate with explicit permission and disclose vulnerabilities responsibly. White-hat hackers work to improve security, while black-hat hackers exploit weaknesses illegally. Students must understand that security skills carry great responsibility and require adherence to professional ethics.
网络安全在法律和道德标准框架内运行。未经授权的访问、恶意软件传播和数据泄露可能触犯《计算机滥用法案》（英国）或其他司法辖区的类似法律。《通用数据保护条例》（GDPR）强制对欧盟公民的数据进行严格保护。道德黑客（即渗透测试者）必须在获得明确许可的情况下工作，并负责任地披露漏洞。白帽黑客致力于提高安全性，而黑帽黑客非法利用弱点。学生必须明白，安全技能伴随着重大责任，并需遵守职业道德。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图