📚 IGCSE Computer Science: Network Security Key Points | IGCSE 计算机：网络安全 考点精讲
In today's interconnected world, network security is one of the most critical topics in IGCSE Computer Science. From malware and phishing to encryption and firewalls, understanding both threats and protective measures is essential for exam success and real-world digital safety.
在网络日益普及的今天，网络安全已成为IGCSE计算机科学最关键的考点之一。无论是恶意软件、网络钓鱼，还是加密与防火墙技术，深刻理解各种威胁及其防御措施对于应对考试和保障现实世界的数字安全都至关重要。
1. Common Cyber Security Threats | 常见网络安全威胁
A cyber security threat is any action or technology that attempts to damage, steal or disrupt data, systems or networks. Threats can be human-based, such as social engineering, or technology-based, such as malicious code. IGCSE candidates need to recognise and explain a wide range of threats and describe how each one compromises data integrity, confidentiality or availability.
网络安全威胁是指任何试图破坏、窃取或干扰数据、系统或网络的行为或技术。威胁可以是基于人的，例如社会工程学攻击，也可以是基于技术的，例如恶意代码。IGCSE考生需要识别并解释各类威胁，并说明它们如何破坏数据的完整性、保密性或可用性。
The key triad to remember is CIA: Confidentiality (ensuring only authorised parties access data), Integrity (ensuring data is accurate and not tampered with), and Availability (ensuring systems and data are accessible when needed). Most attacks target one or more of these principles.
需要记住的关键原则是CIA三要素：保密性（确保只有授权方可访问数据）、完整性（确保数据准确且未被篡改）以及可用性（确保系统和数据在需要时能够访问）。大多数攻击都针对其中一项或多项原则。
2. Malware: Viruses, Worms, Trojans and Spyware | 恶意软件：病毒、蠕虫、木马和间谍软件
Malware (malicious software) is software designed to infiltrate or damage a computer system without the owner's informed consent. A virus attaches itself to a legitimate program or file and spreads when that file is executed. A worm is a standalone program that replicates itself across a network without needing a host file. A Trojan horse disguises itself as useful software but delivers a malicious payload. Spyware secretly monitors user activity and collects personal data, often for advertising or fraud.
恶意软件（恶意软件）是旨在未经所有者知情同意的情况下入侵或破坏计算机系统的软件。病毒会附着在合法程序或文件上，并在文件执行时传播。蠕虫是一种独立程序，无需宿主文件即可通过网络自我复制。特洛伊木马伪装成有用软件，但会传递恶意负载。间谍软件则会秘密监视用户活动并收集个人数据，常用于广告推送或欺诈。
For the exam, you must be able to compare these types: a virus requires user interaction to spread, while a worm exploits network vulnerabilities and spreads automatically. Ransomware is another modern threat that encrypts files and demands payment; it often behaves like a hybrid of worm and Trojan.
考试中，你需要能够比较这些类型：病毒需要用户交互才能传播，而蠕虫则利用网络漏洞自动传播。勒索软件是另一种现代威胁，它会加密文件并要求支付赎金，其行为常常结合了蠕虫和木马的特点。
3. Phishing, Pharming and Social Engineering | 网络钓鱼、域欺骗与社会工程学
Phishing is a social-engineering attack where attackers send fraudulent emails or messages that appear to come from a trusted source, tricking users into revealing sensitive information such as passwords or credit card numbers. Pharming is a more technical attack that redirects a legitimate website's traffic to a fake site, often by exploiting DNS server vulnerabilities or poisoning the host file on a computer.
网络钓鱼是一种社会工程攻击，攻击者发送看似来自可信来源的欺诈性邮件或消息，诱骗用户泄露密码或信用卡号等敏感信息。域欺骗则是一种技术性更强的攻击，通常通过利用DNS服务器漏洞或污染计算机上的主机文件，将合法网站的流量重定向到虚假网站。
Social engineering exploits human psychology rather than technical weaknesses. Attackers may use pretexting (creating a fabricated scenario) or baiting (offering something enticing) to gain access. For IGCSE, be clear: phishing relies on deception via electronic communication, pharming operates at the network level, and shoulder surfing or dumpster diving are other forms of social engineering.
社会工程学利用的是人类心理而非技术弱点。攻击者可能使用托词（编造虚假场景）或诱饵（提供诱人的物品）来获取访问权限。在IGCSE中要明确：网络钓鱼依赖电子通信欺骗，域欺骗在网络层面运作，而肩窥或垃圾搜寻则是社会工程学的其他形式。
4. Brute-Force Attacks and Denial of Service (DoS) | 暴力破解与拒绝服务攻击
A brute-force attack is a trial-and-error method used to obtain passwords or encryption keys by systematically trying every possible combination until the correct one is found. Automated tools can test thousands of combinations per second. Longer, more complex passwords and account lockout policies are effective countermeasures.
暴力破解攻击是一种通过系统地尝试所有可能的组合来获取密码或加密密钥的试错方法，直到找到正确的一项。自动化工具每秒可测试数千种组合。更长、更复杂的密码以及账户锁定策略是有效的应对措施。
A Denial of Service (DoS) attack aims to make a server or network resource unavailable by overwhelming it with a flood of illegitimate requests. A Distributed DoS (DDoS) attack uses many compromised computers (a botnet) to launch the attack simultaneously, making it harder to mitigate. This compromises availability. Firewalls, rate limiting and traffic filtering help defend against DoS attacks.
拒绝服务攻击旨在通过大量非法请求使服务器或网络资源过载，从而导致其不可用。分布式拒绝服务攻击则利用大量被攻陷的计算机（僵尸网络）同时发起攻击，使其更难缓解。这种攻击破坏了可用性。防火墙、速率限制和流量过滤有助于防御拒绝服务攻击。
5. SQL Injection and Data Interception | SQL注入与数据拦截
SQL injection is a code-injection technique that exploits vulnerabilities in a website's data-input fields to manipulate the back-end database. An attacker enters malicious SQL statements that can retrieve, modify or delete database records, potentially exposing entire user tables. Using parameterised queries and input validation prevents SQL injection.
SQL注入是一种代码注入技术，它利用网站数据输入字段中的漏洞来操纵后端数据库。攻击者输入恶意的SQL语句，可以检索、修改或删除数据库记录，可能暴露整个用户表。使用参数化查询和输入验证可以防止SQL注入。
Data interception refers to the unauthorised capture of data as it travels across a network. Packet sniffers can monitor unencrypted traffic, enabling attackers to read usernames, passwords and messages. Encryption, such as WPA2 for Wi-Fi or HTTPS for web traffic, is the primary defence against data interception. The IGCSE syllabus also expects you to mention that changing default passwords on network devices reduces interception risks.
数据拦截是指未经授权截取网络上传输的数据。数据包嗅探器可以监控未加密的流量，使攻击者能够读取用户名、密码和消息。加密（例如用于Wi-Fi的WPA2或用于网络流量的HTTPS）是对抗数据拦截的主要防御手段。IGCSE大纲还要求你提到，更改网络设备的默认密码可以降低拦截风险。
6. Protecting Systems: Firewalls and Proxy Servers | 保护系统：防火墙与代理服务器
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules. It acts as a barrier between a trusted internal network and untrusted external networks, such as the Internet. Firewalls can be hardware, software or a combination, and they filter packets by IP address, port number and protocol.
防火墙是一种网络安全系统，根据预设的安全规则监控和控制进出网络的流量。它充当可信内部网络与不可信外部网络（如互联网）之间的屏障。防火墙可以是硬件、软件或两者结合，并通过IP地址、端口号和协议来过滤数据包。
A proxy server acts as an intermediary between a user's device and the Internet. It forwards requests and returns responses, hiding the user's real IP address. Proxy servers can also cache frequently accessed web pages, filter content and log user activity. In an exam, distinguish a proxy from a firewall: a proxy operates at the application layer, changing the source address of traffic, while a firewall primarily filters packets based on rules without altering them.
代理服务器充当用户设备与互联网之间的中介。它转发请求并返回响应，隐藏用户的真实IP地址。代理服务器还可以缓存常访问的网页、过滤内容并记录用户活动。在考试中，要将代理与防火墙区分开：代理在应用层运行，改变流量的源地址，而防火墙主要根据规则过滤数据包而不修改它们。
7. Anti-Malware Software and Security Updates | 反恶意软件与安全更新
Anti-malware (or antivirus) software detects, quarantines and removes malicious code. It uses signature-based detection (comparing files against a database of known threats) and heuristic analysis (identifying suspicious behaviour). Regular updates to the malware signature database are crucial to protect against new threats.
反恶意软件（或防病毒软件）可检测、隔离和删除恶意代码。它使用基于签名的检测（将文件与已知威胁数据库进行比较）和启发式分析（识别可疑行为）。定期更新恶意软件签名数据库对于防范新威胁至关重要。
Operating system and application security patches fix known vulnerabilities that malware can exploit. Many high-profile data breaches have occurred because organisations failed to apply critical updates. IGCSE questions often link the lack of updates to increased risk of worm propagation and eavesdropping.
操作系统和应用程序的安全补丁可修复恶意软件可能利用的已知漏洞。许多大规模数据泄露事件都是因为组织未能及时应用关键更新。IGCSE试题常将缺乏更新与蠕虫传播和窃听风险增加联系起来。
8. Encryption: Symmetric and Asymmetric | 加密：对称与非对称加密
Encryption is the process of converting plaintext into ciphertext using an algorithm and a key. Symmetric encryption uses the same key for both encryption and decryption. It is fast and suitable for bulk data but requires a secure method of key exchange. Common symmetric algorithms include AES and DES.
加密是使用算法和密钥将明文转换为密文的过程。对称加密在加密和解密时使用相同的密钥。它速度快，适合批量数据，但需要安全的密钥交换方法。常见的对称加密算法包括AES和DES。
Asymmetric encryption uses a pair of keys: a public key, which is shared openly, and a private key, which is kept secret. Data encrypted with the public key can only be decrypted with the matching private key. This solves the key-exchange problem and is used in digital signatures and SSL/TLS. RSA is a widely used asymmetric algorithm. In IGCSE, you need to explain how asymmetric encryption enables secure initial communication, after which a symmetric session key is exchanged for efficiency.
非对称加密使用一对密钥：公开共享的公钥和保密的私钥。用公钥加密的数据只能用对应的私钥解密。这解决了密钥交换问题，并用于数字签名和SSL/TLS。RSA是一种广泛使用的非对称算法。在IGCSE中，你需要解释非对称加密如何实现安全的初始通信，之后为提高效率会交换对称会话密钥。
9. Authentication: Passwords, Biometrics and Two-Factor Authentication | 身份验证：密码、生物识别和双因素认证
Authentication verifies the identity of a user or device. Methods range from simple passwords to more advanced biometric systems. Strong passwords (long, mixed-case, with symbols) reduce the risk of brute-force attacks. However, passwords alone are vulnerable to shoulder surfing, keyloggers and phishing.
身份验证是确认用户或设备身份的过程。方法从简单的密码到更先进的生物识别系统不一而足。强密码（长度长、大小写混合、包含符号）可以降低暴力破解攻击的风险。然而，仅凭密码容易受到肩窥、键盘记录器和网络钓鱼的攻击。
Biometric authentication uses unique physical characteristics, such as fingerprints, iris patterns or voice recognition. Biometrics are difficult to replicate but raise privacy concerns if stored insecurely. Two-factor authentication (2FA) combines two different types of evidence: something the user knows (password), something the user has (a mobile device or token), or something the user is (biometric). 2FA drastically improves security because compromising both factors is significantly harder.
生物识别身份验证使用独特的身体特征，例如指纹、虹膜模式或语音识别。生物特征难以复制，但如果存储不当会引发隐私问题。双因素认证结合了两种不同类型的凭据：用户所知（密码）、用户所有（移动设备或令牌）或用户本人的特征（生物识别）。双因素认证极大地提高了安全性，因为要同时攻破两个因素要困难得多。
10. Secure Data Transmission: SSL/TLS and HTTPS | 安全数据传输：SSL/TLS与HTTPS
Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are cryptographic protocols that provide secure communication over a network. They establish an encrypted link between a web server and a browser, ensuring that all data passed between them remains private and integral. The URL prefix 'https' indicates that the connection is secured using SSL/TLS.
安全套接字层（SSL）及其继任者传输层安全（TLS）是提供网络安全通信的加密协议。它们在Web服务器和浏览器之间建立加密链接，确保两者之间传递的所有数据保持私密和完整。URL前缀“https”表示连接已使用SSL/TLS进行安全保护。
During the TLS handshake, the server presents a digital certificate, the client authenticates the server, and then a symmetric session key is generated for the remainder of the session. This hybrid approach combines asymmetric encryption for key exchange with symmetric encryption for performance. IGCSE candidates should be able to identify the padlock symbol in a browser and explain why HTTPS is essential for e-commerce and login pages.
在TLS握手过程中，服务器出示数字证书，客户端验证服务器身份，然后生成对称会话密钥用于之后的会话。这种混合方法将用于密钥交换的非对称加密与用于性能的对称加密结合起来。IGCSE考生应能识别浏览器中的挂锁符号，并解释为何HTTPS对电子商务和登录页面至关重要。
11. Digital Certificates and Trusted Authorities | 数字证书与可信机构
A digital certificate is an electronic document used to prove ownership of a public key. It contains information about the key, the identity of its owner, and the digital signature of a Certificate Authority (CA) that has verified the contents. When you visit a secure website, the browser checks the certificate to confirm that the site is genuine.
数字证书是一种用于证明公钥所有权的电子文档。它包含有关密钥的信息、所有者身份以及已验证该内容的证书颁发机构的数字签名。当你访问安全网站时，浏览器会检查证书以确认该网站是真实的。
Trusted authorities such as DigiCert or Let's Encrypt form the backbone of trust on the Internet. If a certificate is expired, self-signed or issued by an untrusted CA, the browser displays a warning. IGCSE exams may ask you to explain how certificates prevent man-in-the-middle attacks by ensuring that the public key you receive indeed belongs to the intended server.
可信机构（如DigiCert或Let's Encrypt）构成了互联网信任的基石。如果证书过期、自签或由不受信任的CA签发，浏览器会显示警告。IGCSE考试可能会要求你解释证书如何通过确保你收到的公钥确实属于目标服务器来防止中间人攻击。
12. Access Rights, User Accounts and Acceptable Use Policies | 访问权限、用户账户与可接受使用政策
Access rights control what individual users can view or modify on a network. By assigning different permission levels (read, write, execute, delete), system administrators enforce the principle of least privilege. This reduces the damage caused by malware or accidental misuse by limiting what any single account can do.
访问权限控制着单个用户在网络中可查看或修改的内容。通过分配不同的权限级别（读取、写入、执行、删除），系统管理员可执行最小特权原则。这通过限制任何单个账户的操作范围，减少了恶意软件或意外误用造成的损害。
An Acceptable Use Policy (AUP) is a set of rules that defines the ways in which network resources may be used. It covers topics such as not downloading unauthorised software, not sharing passwords, reporting suspicious activity and complying with data protection laws. For IGCSE, you need to understand that technical measures must be complemented by policy measures to create a comprehensive security posture.
可接受使用政策是一套定义网络资源使用方式的规则。它涵盖的议题包括不下载未经授权的软件、不共享密码、报告可疑活动以及遵守数据保护法规。对于IGCSE，你需要明白技术措施必须与政策措施相辅相成，才能形成全面的安全态势。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图