📚 IB Computer Science: Cybersecurity Essentials | IB 计算机：网络安全考点精讲
In today’s interconnected world, cybersecurity is a fundamental pillar of computer science. It deals with protecting systems, networks, programs, and data from digital attacks, damage, or unauthorized access. The IB Computer Science syllabus emphasizes not only the technical aspects of security but also the ethical and social implications of safeguarding information. Understanding the principles of cybersecurity equips students to design robust systems and critically evaluate the vulnerabilities that threaten the digital infrastructure upon which modern society relies.
在当今互联互通的世界，网络安全是计算机科学的基本支柱。它涉及保护系统、网络、程序和数据免受数字攻击、破坏或未经授权的访问。IB 计算机科学大纲不仅强调安全的技术层面，也注重保护信息的伦理和社会影响。理解网络安全原理能够让学生设计出稳健的系统，并批判性地评估威胁现代数字基础设施的脆弱性。
1. Introduction to Cybersecurity | 网络安全简介
Cybersecurity is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. It is also known as information technology security or electronic information security. The core objectives are often summarised by the CIA triad: Confidentiality, ensuring that information is accessible only to those authorised to have access; Integrity, safeguarding the accuracy and completeness of information and processing methods; and Availability, ensuring that authorised users have access to information and associated assets when required.
网络安全是保护计算机、服务器、移动设备、电子系统、网络和数据免受恶意攻击的实践。它也被称为信息技术安全或电子信息安全。其核心目标通常被概括为 CIA 三元组：保密性，确保信息只能被授权者访问；完整性，维护信息及处理方法的准确性和完备性；可用性，确保授权用户在需要时可以访问信息及其相关资产。
2. Common Threats and Malware | 常见威胁与恶意软件
Malware, short for malicious software, is any program intentionally designed to disrupt, damage, or gain unauthorised access to a computer system. Common types include viruses, which attach themselves to clean files and spread uncontrollably; worms, which replicate themselves to spread to other computers without any user action; Trojans, which disguise themselves as legitimate software to trick users into installing them; and ransomware, which encrypts a user’s data and demands payment for the decryption key.
恶意软件是任何故意设计用来破坏、损坏或未经授权访问计算机系统的程序。常见类型包括病毒，它们附着在干净文件上并不受控制地传播；蠕虫，无需用户操作即可自我复制并传播到其他计算机；特洛伊木马，伪装成合法软件诱骗用户安装；以及勒索软件，加密用户数据并要求支付解密密钥的费用。
In addition, spyware secretly monitors user activity and collects information without consent, while adware automatically displays unwanted advertisements. Rootkits enable an attacker to maintain privileged access while hiding their presence from system administrators. The infection vectors often include infected email attachments, malicious downloads, drive-by downloads from compromised websites, and removable media such as USB drives.
此外，间谍软件在未经同意的情况下秘密监视用户活动并收集信息，而广告软件则自动显示不需要的广告。rootkit 使攻击者能够保持特权访问，同时向系统管理员隐藏自身存在。感染途径通常包括受感染的电子邮件附件、恶意下载、来自受感染网站的驱动式下载以及诸如 U 盘等可移动介质。
3. Social Engineering Attacks | 社会工程学攻击
Social engineering exploits human psychology rather than technical hacking techniques to gain access to systems or information. The most prevalent form is phishing, where attackers send fraudulent emails or messages that appear to come from reputable sources to trick individuals into revealing sensitive data such as passwords and credit card numbers. Spear phishing targets specific individuals or organisations with highly personalised messages.
社会工程学利用人类心理学而非技术黑客手段来获取系统或信息的访问权限。最常见的形式是网络钓鱼，攻击者发送看似来自信誉良好的来源的欺诈性电子邮件或消息，诱骗个人泄露密码和信用卡号等敏感数据。鱼叉式网络钓鱼则通过高度个性化的消息针对特定个人或组织。
Pretexting involves creating a fabricated scenario to obtain information, often by impersonating a co-worker, IT support, or a trusted authority. Baiting uses a false promise to pique a victim’s greed or curiosity, such as leaving an infected USB stick in a public place labelled “Confidential Salary Data.” Tailgating, or piggybacking, occurs when an unauthorised person follows an authorised person into a secure area without proper authentication.
借口式攻击通过编造场景来获取信息，通常冒充同事、IT 支持人员或可信机构。诱饵攻击利用虚假承诺来激发受害者的贪婪或好奇心，例如在公共场所留下标有“机密薪资数据”的受感染 U 盘。尾随或搭便车则是指未经授权的人跟在授权人员身后进入安全区域而不经过适当认证。
4. Denial of Service (DoS) and DDoS Attacks | 拒绝服务 (DoS) 与分布式拒绝服务攻击
A Denial of Service (DoS) attack aims to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. A Distributed Denial of Service (DDoS) attack achieves this by overwhelming the target with a flood of traffic from multiple compromised systems, often forming a botnet. These attacks exploit the limited capacity of network resources such as bandwidth, server processing power, or memory.
拒绝服务攻击旨在通过暂时或无限期地中断连接到互联网的主机服务，使计算机或网络资源对其目标用户不可用。分布式拒绝服务攻击则通过利用来自多个受感染系统（通常形成僵尸网络）的流量洪流淹没目标来达成此目的。这些攻击利用了网络资源（如带宽、服务器处理能力或内存）的有限容量。
Common types include volumetric attacks, which consume all available bandwidth; protocol attacks, which exploit weaknesses in the Layer 3 and Layer 4 protocol stack; and application layer attacks, which target specific applications and are often harder to detect because they mimic legitimate requests. Mitigation techniques involve traffic filtering, rate limiting, and content delivery networks (CDNs) that absorb and disperse malicious traffic.
常见类型包括容量攻击，耗尽所有可用带宽；协议攻击，利用第三层和第四层协议栈的弱点；以及应用层攻击，针对特定应用且通常更难检测，因为它们模拟合法请求。缓解技术涉及流量过滤、速率限制以及吸收和分散恶意流量的内容分发网络。
5. Cryptography Basics | 密码学基础
Cryptography is the science of securing information by transforming it into an unreadable format, called ciphertext, using an algorithm and a key. Only those who possess the correct key can decrypt the ciphertext back into the original plaintext. The fundamental goals are confidentiality, data integrity, authentication, and non-repudiation. Cryptography relies on mathematical principles; without the key, reversing the encryption should be computationally infeasible.
密码学是一门通过使用算法和密钥将信息转换为不可读格式（称为密文）来保护信息安全的科学。只有拥有正确密钥的人才能将密文解密回原始明文。基本目标是保密性、数据完整性、身份验证和不可否认性。密码学依赖于数学原理；在没有密钥的情况下，逆转加密在计算上应是不可行的。
Keys are strings of bits used by the cryptographic algorithm. Modern cryptography distinguishes between symmetric encryption, where the same key is used for both encryption and decryption, and asymmetric encryption, which uses a pair of mathematically linked keys – a public key and a private key. The security of a cryptosystem should rest entirely in the secrecy of the key, not in the secrecy of the algorithm, as per Kerckhoffs’s principle.
密钥是加密算法使用的比特串。现代密码学区分对称加密（使用相同密钥进行加密和解密）和非对称加密（使用一对数学上关联的密钥——公钥和私钥）。根据 Kerckhoffs 原则，密码系统的安全性应完全依赖于密钥的保密性，而非算法的保密性。
6. Symmetric vs Asymmetric Encryption | 对称加密与非对称加密
Symmetric encryption, also called secret-key encryption, uses a single shared key for both encryption and decryption. It is fast and efficient, making it ideal for encrypting large amounts of data. Examples include AES (Advanced Encryption Standard) and DES (Data Encryption Standard). The main challenge is secure key distribution: both communicating parties must possess the same key, and if the key is intercepted during transmission, the communication is compromised.
对称加密，也称为私钥加密，使用单一共享密钥进行加密和解密。它速度快、效率高，非常适合加密大量数据。示例包括 AES（高级加密标准）和 DES（数据加密标准）。主要挑战是安全的密钥分发：通信双方必须拥有相同的密钥，如果密钥在传输过程中被拦截，通信就会被破坏。
Asymmetric encryption, or public-key cryptography, employs a pair of keys: a public key, which can be shared openly, and a private key, which is kept secret. Data encrypted with the public key can only be decrypted by the corresponding private key, and vice versa. This solves the key distribution problem but is computationally slower. RSA and ECC (Elliptic Curve Cryptography) are widely used asymmetric algorithms. A hybrid system often combines both: asymmetric encryption is used to securely exchange a symmetric session key, and then the bulk data is encrypted with symmetric encryption.
非对称加密，即公钥密码学，采用一对密钥：公钥可以公开共享，而私钥则保密。使用公钥加密的数据只能由对应的私钥解密，反之亦然。这解决了密钥分发问题，但计算速度较慢。RSA 和 ECC（椭圆曲线密码学）是广泛使用的非对称算法。混合系统通常将两者结合：使用非对称加密安全地交换对称会话密钥，然后使用对称加密对大量数据进行加密。
| Feature | Symmetric Encryption | Asymmetric Encryption |
|---|---|---|
| Keys | Single shared key | Key pair (public + private) |
| Speed | Fast | Slow (100-1000x slower) |
| Key distribution | Difficult, must be kept secret | Easy, public key can be open |
| Use case | Bulk data encryption | Key exchange, digital signatures |
7. Hash Functions and Digital Signatures | 哈希函数与数字签名
A hash function takes an input (or message) and returns a fixed-size string of bytes, typically a digest that appears random. It is deterministic, meaning the same input always produces the same hash. Cryptographic hash functions have critical properties: pre-image resistance (it is infeasible to reverse the hash to find the original input), second pre-image resistance (finding another input with the same hash is infeasible), and collision resistance (it is infeasible to find two different inputs with the same hash). Common algorithms include SHA-256 and MD5 (though MD5 is no longer considered secure).
哈希函数接受一个输入（或消息）并返回一个固定大小的字节串，通常是一个看起来随机的摘要。它是确定性的，意味着相同的输入总是产生相同的哈希值。密码哈希函数具有关键属性：原像抗性（通过哈希值逆向找到原始输入不可行）、第二原像抗性（寻找另一个具有相同哈希的输入不可行）和碰撞抗性（寻找两个不同输入产生相同哈希不可行）。常见算法包括 SHA-256 和 MD5（尽管 MD5 已不再被认为是安全的）。
Digital signatures use asymmetric cryptography to provide authentication, non-repudiation, and integrity. The sender creates a hash of the message and encrypts that hash with their private key; the result is the digital signature. The recipient decrypts the signature with the sender’s public key to recover the hash and then independently hashes the original message. If the two hashes match, the signature is valid, proving that the message has not been altered and that it truly originated from the claimed sender.
数字签名使用非对称密码学提供身份验证、不可否认性和完整性。发送方创建消息的哈希值并使用自己的私钥加密该哈希；结果即为数字签名。接收方使用发送方的公钥解密签名以恢复哈希，然后独立地对原始消息进行哈希处理。如果两个哈希值匹配，签名有效，证明消息未被篡改且确实来自声称的发送方。
8. Firewalls and Network Security | 防火墙与网络安全
A firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organisation’s previously established security policies. It acts as a barrier between a trusted internal network and untrusted external networks, such as the Internet. Firewalls can be hardware-based, software-based, or a combination of both.
防火墙是一种网络安全设备，根据组织预先制定的安全策略监控和过滤传入和传出的网络流量。它在可信内部网络和不可信外部网络（如互联网）之间充当屏障。防火墙可以基于硬件、软件或两者的组合。
Packet-filtering firewalls inspect packets at the network layer and make decisions based on source and destination IP addresses, ports, and protocols. Stateful inspection firewalls track the state of active connections and make decisions within the context of the traffic flow. Application-level gateways (proxy firewalls) filter traffic at the application layer, providing deep packet inspection and additional security such as user authentication. Next-Generation Firewalls (NGFW) integrate intrusion prevention, deep packet inspection, and application awareness.
包过滤防火墙在网络层检查数据包，并根据源和目标 IP 地址、端口和协议做出决策。状态检测防火墙跟踪活动连接的状态，并在流量上下文中做出决策。应用级网关（代理防火墙）在应用层过滤流量，提供深度数据包检测以及用户认证等额外安全功能。下一代防火墙集成了入侵防御、深度数据包检测和应用感知。
9. Secure Protocols (SSL/TLS and HTTPS) | 安全协议 (SSL/TLS 与 HTTPS)
Secure Sockets Layer (SSL) and its successor Transport Layer Security (TLS) are cryptographic protocols designed to provide secure communication over a computer network. They are commonly used to secure web browsing, email, instant messaging, and VoIP. TLS operates between the application layer and the transport layer in the OSI model, ensuring that data exchanged is encrypted and authenticated.
安全套接字层及其后继者传输层安全是旨在通过计算机网络提供安全通信的密码学协议。它们通常用于保护网络浏览、电子邮件、即时消息和 VoIP。TLS 在 OSI 模型中的应用层和传输层之间运行，确保交换的数据经过加密和身份验证。
HTTPS (HTTP Secure) is the combination of HTTP with TLS. When a browser connects to an HTTPS website, a TLS handshake occurs: the server presents its digital certificate containing its public key, and the client verifies the certificate with a trusted Certificate Authority (CA). Then, symmetric session keys are securely exchanged and used to encrypt subsequent data. The presence of the padlock icon in the browser and the ‘https://’ prefix indicate an active TLS session, protecting against eavesdropping and man-in-the-middle attacks.
HTTPS（HTTP 安全）是 HTTP 与 TLS 的结合。当浏览器连接到 HTTPS 网站时，会进行 TLS 握手：服务器出示包含其公钥的数字证书，客户端使用受信任的证书颁发机构验证该证书。然后，对称会话密钥被安全交换并用于加密后续数据。浏览器中挂锁图标和“https://”前缀表示存在活动的 TLS 会话，可防止窃听和中间人攻击。
10. Authentication and Access Control | 身份验证与访问控制
Authentication is the process of verifying the identity of a user, device, or process. It is commonly based on one or more factors: something you know (password, PIN), something you have (smart card, security token), and something you are (biometrics like fingerprints or iris scans). Multi-factor authentication (MFA) combines two or more of these factors to provide stronger security, significantly reducing the risk of unauthorised access even if one factor is compromised.
身份验证是验证用户、设备或进程身份的过程。它通常基于一个或多个因素：你知道的东西（密码、PIN）、你拥有的东西（智能卡、安全令牌）和你是什么（生物识别如指纹或虹膜扫描）。多因素认证结合了其中两个或更多因素以提供更强的安全性，即使其中一个因素被攻破，也能显著降低未经授权访问的风险。
Access control determines who is allowed to access what resources under which conditions. Common models include Discretionary Access Control (DAC), where the resource owner decides access; Mandatory Access Control (MAC), based on security labels and clearances; and Role-Based Access Control (RBAC), where permissions are assigned to roles rather than individuals. Properly implemented access control ensures the principle of least privilege, meaning users are granted only the minimum permissions necessary to perform their tasks.
访问控制决定谁在什么条件下可以访问哪些资源。常见模型包括自主访问控制，由资源所有者决定访问权限；强制访问控制，基于安全标签和许可；以及基于角色的访问控制，权限分配给角色而非个人。正确实施的访问控制遵循最小权限原则，即用户只被授予执行任务所需的最低权限。
11. Data Backup, Recovery, and Disaster Planning | 数据备份、恢复与灾难规划
Data backup involves creating copies of data that can be restored in the event of primary data failure, accidental deletion, corruption, or a cyber-incident such as ransomware. A robust backup strategy follows the 3-2-1 rule: keep at least three copies of the data, store two backup copies on different storage media, and keep one copy off-site. Backups can be full, incremental, or differential, balancing storage space and recovery time.
数据备份涉及创建数据副本，以便在主数据故障、意外删除、损坏或勒索软件等网络事件发生时可以恢复。稳健的备份策略遵循 3-2-1 规则：至少保留三份数据副本，在两个不同的存储介质上存储两份备份，并将一份副本保存在异地。备份可以是完整、增量或差异备份，以平衡存储空间和恢复时间。
Disaster recovery plans detail how an organisation will resume operations after a major incident. They include Recovery Point Objective (RPO), the maximum acceptable amount of data loss measured in time, and Recovery Time Objective (RTO), the maximum tolerable length of time that a system can be down. Testing backups regularly is crucial, because a backup that cannot be restored is no better than no backup at all.
灾难恢复计划详细说明组织在发生重大事件后如何恢复运营。它们包括恢复点目标，即以时间度量可接受的最大数据丢失量，和恢复时间目标，即系统可停机的最长可容忍时间。定期测试备份至关重要，因为无法恢复的备份无异于根本没有备份。
12. Ethics, Policies, and Legal Aspects | 伦理、政策与法律因素
Cybersecurity extends beyond technical measures to encompass ethical behaviour, corporate policies, and legal compliance. An Acceptable Use Policy (AUP) defines what users are permitted and not permitted to do with the organisation’s IT resources. Security policies should address password management, remote access, incident response, and data classification. Employees must be trained to recognise threats and follow procedures.
网络安全不仅限于技术措施，还涵盖伦理行为、公司政策和法律合规。可接受使用政策定义了用户被允许和不被允许使用组织 IT 资源的行为。安全策略应涉及密码管理、远程访问、事件响应和数据分类。必须培训员工识别威胁并遵循程序。
From a legal standpoint, regulations such as the General Data Protection Regulation (GDPR) in the EU impose strict requirements on the collection, storage, and processing of personal data, with heavy penalties for breaches. Ethical considerations include the responsible disclosure of vulnerabilities, avoiding the creation or distribution of malware, and protecting user privacy. Professionals must balance security needs with individual rights, ensuring that monitoring and surveillance do not infringe disproportionately on personal freedoms.
从法律角度来看，诸如欧盟《通用数据保护条例》等法规对个人数据的收集、存储和处理提出了严格要求，并对违规行为处以重罚。伦理考量包括负责任地披露漏洞、避免创建或传播恶意软件以及保护用户隐私。专业人员必须在安全需求与个人权利之间取得平衡，确保监控和监督不会过度侵犯个人自由。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导