GCSE CCEA Computer Science: Cyber Security | GCSE CCEA 计算机：网络安全考点精讲

📚 GCSE CCEA Computer Science: Cyber Security | GCSE CCEA 计算机：网络安全考点精讲

Cyber security protects computer systems, networks and data from digital attacks, theft and damage. In the CCEA GCSE Computer Science specification, this topic covers the main threats, the techniques used by attackers, and the methods organisations and individuals use to defend against them. Understanding cyber security is essential in a world where most of our personal, financial and professional information is stored online.

网络安全保护计算机系统、网络和数据免受数字攻击、盗窃和破坏。在 CCEA GCSE 计算机科学大纲中，本主题涵盖主要威胁、攻击者使用的技术，以及组织和个人采用的防御方法。在我们大多数个人信息、财务信息和职业信息都存储在网上的时代，理解网络安全至关重要。

1. What is Cyber Security? | 什么是网络安全？

Cyber security refers to the practice of defending computers, servers, mobile devices, electronic systems, networks and data from malicious attacks. It involves a combination of technologies, processes and human behaviour designed to reduce the risk of unauthorised access or damage.

网络安全是指保护计算机、服务器、移动设备、电子系统、网络和数据免受恶意攻击的实践。它结合了技术、流程和人类行为，旨在降低未经授权访问或破坏的风险。

In the CCEA exam, you need to be able to explain why cyber security is important for individuals, businesses and governments. This includes protecting confidentiality (keeping data secret), integrity (ensuring data is not altered without permission) and availability (ensuring systems are accessible when needed). These three concepts are often called the CIA triad.

在 CCEA 考试中，你需要能够解释为什么网络安全对个人、企业和政府很重要。这包括保护机密性（保持数据保密）、完整性（确保数据未经许可不被篡改）和可用性（确保系统在需要时可以访问）。这三个概念通常被称为 CIA 三元组。

2. Types of Malware | 恶意软件类型

Malware is malicious software designed to infiltrate or damage a computer system without the owner’s consent. The most common forms you must know for the GCSE include:

恶意软件是设计用来在不经用户同意的情况下侵入或破坏计算机系统的恶意软件。你需要在 GCSE 中了解的最常见形式包括：

Virus – a program that attaches itself to legitimate files and spreads when the file is opened.
病毒 – 一种附着在合法文件上的程序，当文件被打开时传播。
Worm – a self‑replicating program that spreads over networks without needing to attach to a file.
蠕虫 – 一种自我复制的程序，不需要附着到文件就能通过网络传播。
Trojan horse – appears to be useful software but secretly carries out harmful actions.
特洛伊木马 – 看似有用的软件，但秘密执行有害操作。
Spyware – secretly monitors user activity and collects personal information.
间谍软件 – 秘密监视用户活动并收集个人信息。
Ransomware – encrypts the victim’s files and demands payment to restore access.
勒索软件 – 加密受害者文件并要求付款以恢复访问权限。

Exam questions often ask you to compare these types or identify which one is being described in a scenario.

考试问题经常要求你比较这些类型，或在场景中识别描述的是哪一种。

3. Social Engineering & Phishing | 社会工程与钓鱼攻击

Social engineering is a technique that exploits human psychology rather than technical weaknesses. Attackers manipulate people into revealing confidential information or performing actions that compromise security.

社会工程是一种利用人类心理而非技术弱点的技术。攻击者操纵人们泄露机密信息或执行危害安全的操作。

The most widespread form is phishing: fraudulent emails or text messages that appear to come from trusted organisations. They often create a sense of urgency, asking the victim to click a link and enter personal details on a fake website. A more targeted version is spear phishing, which uses personalised information to make the attack more convincing.

最常见的形式是网络钓鱼：伪装成来自可信组织的欺诈性电子邮件或短信。它们通常制造紧迫感，要求受害者点击链接并在虚假网站上输入个人详细信息。更具针对性的版本是鱼叉式网络钓鱼，它利用个性化信息使攻击更有说服力。

Other social engineering methods include pretexting (inventing a scenario to obtain information) and shoulder surfing (watching someone type their password).

其他社会工程方法包括借口哄骗（编造情景以获取信息）和肩窥（偷看他人输入密码）。

4. Network Attacks: Brute Force, DoS, SQL Injection | 网络攻击：暴力破解、拒绝服务、SQL 注入

Attackers use a range of network‑based techniques to breach security. The three you must understand are:

攻击者使用一系列基于网络的技术来破坏安全性。你必须理解的三种是：

Brute force attack – an automated attempt to guess a password by trying every possible combination. It can be prevented by account lockout policies and strong password rules.
暴力破解攻击 – 通过尝试每种可能的组合自动猜测密码。可以通过账户锁定策略和强密码规则来防止。
Denial of Service (DoS) – floods a server or network with excessive traffic to make it unavailable to legitimate users. A distributed denial of service (DDoS) uses many compromised devices (a botnet) to launch the attack simultaneously.
拒绝服务攻击 (DoS) – 用过多流量淹没服务器或网络，使其对合法用户不可用。分布式拒绝服务攻击 (DDoS) 使用许多受感染的设备（僵尸网络）同时发动攻击。
SQL injection – inserts malicious SQL code into a website’s input field, tricking the database into revealing data or making unauthorised changes. It exploits poorly validated user input.
SQL 注入 – 将恶意 SQL 代码插入网站输入字段，诱骗数据库泄露数据或进行未经授权的更改。它利用验证不佳的用户输入。

In the exam, you may be given a scenario and asked to name the attack type and suggest a suitable defence.

在考试中，你可能会被给出一个场景，被要求说出攻击类型并提出适当的防御措施。

5. Defensive Measures: Firewalls & Encryption | 防御措施：防火墙与加密

Firewalls are security systems that monitor and control incoming and outgoing network traffic based on predetermined rules. They act as a barrier between a trusted internal network and untrusted external networks, blocking unauthorised access.

防火墙是根据预定规则监控和控制进出网络流量的安全系统。它们充当受信任的内部网络与不可信的外部网络之间的屏障，阻止未经授权的访问。

Encryption is the process of converting plaintext into ciphertext using an algorithm and a key, so that only authorised parties with the correct key can read it. Symmetric encryption uses the same key for encryption and decryption, while asymmetric encryption uses a public and private key pair. Encryption protects data at rest (stored) and in transit (being sent over a network).

加密是使用算法和密钥将明文转换为密文的过程，以便只有拥有正确密钥的授权方才能读取。对称加密使用同一个密钥进行加密和解密，而非对称加密使用公钥和私钥对。加密保护静态数据（存储）和传输中的数据（通过网络发送）。

You should be able to explain how both technologies help maintain confidentiality and integrity.

你应该能够解释这两种技术如何帮助维护机密性和完整性。

6. Authentication: Passwords & Two‑Factor Authentication | 认证：密码与双因素认证

Authentication is the process of verifying a user’s identity before granting access to a system. Strong authentication methods reduce the risk of unauthorised access.

认证是在授予系统访问权限之前验证用户身份的过程。强大的认证方法可以降低未经授权访问的风险。

A good password policy requires long, complex passwords that mix uppercase, lowercase, numbers and symbols, and are changed regularly. However, passwords alone can be vulnerable to brute force or social engineering.

良好的密码策略要求使用长且复杂的密码，混合大小写字母、数字和符号，并定期更改。然而，仅靠密码容易受到暴力破解或社会工程的攻击。

Two‑factor authentication (2FA) adds a second layer of security by requiring something you know (password) and something you have (a mobile device to receive a code, a hardware token) or something you are (biometrics like fingerprint or face recognition). 2FA makes it much harder for attackers to gain access, even if a password is compromised.

双因素认证 (2FA) 通过要求你知道的某物（密码）和你拥有的某物（接收代码的移动设备、硬件令牌）或你本身的特征（指纹或面部识别等生物特征）来增加第二层安全。2FA 大大增加了攻击者即使获得密码也难以访问的难度。

7. Anti‑Malware Software & Software Updates | 反恶意软件与软件更新

Anti‑malware software (often called antivirus) detects and removes malicious software by scanning files and monitoring system behaviour. It uses signature‑based detection (comparing files against a database of known malware signatures) and heuristic analysis (looking for suspicious behaviour patterns). Real‑time protection is crucial to catch threats as they appear.

反恶意软件（通常称作杀毒软件）通过扫描文件和监控系统行为来检测和删除恶意软件。它使用基于签名的检测（将文件与已知恶意软件签名数据库进行比较）和启发式分析（寻找可疑行为模式）。实时保护对于在威胁出现时立即捕获至关重要。

Software updates (patches) are released by developers to fix security vulnerabilities that could be exploited by attackers. Keeping operating systems, applications and firmware up to date is one of the simplest and most effective defences against cyber‑attacks. Many attacks exploit known vulnerabilities for which patches already exist.

软件更新（补丁）由开发者发布，用于修复可能被攻击者利用的安全漏洞。使操作系统、应用程序和固件保持最新是防御网络攻击最简单也最有效的方法之一。许多攻击利用的是已知漏洞，而这些漏洞的补丁早已存在。

8. Data Protection & Legal Responsibilities | 数据保护与法律责任

Organisations that collect and process personal data must comply with data protection laws. In the UK, the key legislation is the Data Protection Act 2018, which incorporates the EU’s General Data Protection Regulation (GDPR). These laws set strict rules about how data can be collected, stored, used and shared.

收集和处理个人数据的组织必须遵守数据保护法律。在英国，关键立法是2018 年数据保护法案，它融合了欧盟的《通用数据保护条例》(GDPR)。这些法律对数据的收集、存储、使用和共享方式设定了严格规则。

Key principles include: data must be processed fairly and lawfully, collected for specified purposes, adequate and relevant, accurate, not kept longer than necessary, and kept secure. Individuals have rights to access their data, correct inaccuracies and request deletion.

关键原则包括：数据必须公平合法地处理，为指定目的收集，充分且相关，准确，保存时间不超过必要期限，并得到安全保管。个人有权访问自己的数据、更正不准确之处并请求删除。

CCEA questions often ask you to explain the implications of data breaches for an organisation and the steps that should be taken to comply with the law.

CCEA 考题经常要求你解释数据泄露对组织的影响，以及为遵守法律应采取的步骤。

9. Ethical Hacking & Penetration Testing | 道德黑客与渗透测试

Not all hacking is criminal. Ethical hacking (also known as penetration testing or ‘pen testing’) is the authorised practice of attempting to breach a system’s defences in order to identify vulnerabilities before malicious hackers do.

并非所有黑客行为都是犯罪。道德黑客（也称渗透测试或“笔测试”）是经过授权的，在恶意黑客之前尝试突破系统防御以识别漏洞的做法。

Penetration testers follow a structured process: reconnaissance (gathering information), scanning, gaining access, maintaining access and covering tracks. They produce a report that helps the organisation fix security gaps. CCEA expects you to understand that ethical hacking must be done with explicit permission and within legal boundaries.

渗透测试人员遵循结构化流程：侦察（收集信息）、扫描、获取访问权限、维持访问权限和掩盖痕迹。他们生成报告，帮助组织修补安全漏洞。CCEA 希望你理解，道德黑客必须在明确许可和合法范围内进行。

10. Backup & Disaster Recovery | 备份与灾难恢复

Even with strong defences, security incidents may still occur. An effective cyber security strategy includes backup and disaster recovery plans to ensure business continuity.

即使有强大的防御措施，安全事件仍可能发生。有效的网络安全策略包括备份和灾难恢复计划，以确保业务连续性。

A backup is a copy of important data stored separately from the original, often on external drives, cloud storage or tape. Backups should be automated, regular, and tested to ensure data can be restored. The 3‑2‑1 rule is widely recommended: keep at least three copies of the data, on two different media, with one copy offsite.

备份是重要数据的副本，与原始数据分开存储，通常放在外置硬盘、云存储或磁带上。备份应是自动化、定期的，并经过测试以确保数据可以恢复。广泛推荐的3‑2‑1 规则是：至少保留三份数据副本，放在两种不同介质上，并有一份异地保存。

Disaster recovery is the process of restoring systems and data after a major failure. It involves having a documented plan, prioritising critical operations and regularly rehearsing the recovery procedure. This topic links to availability in the CIA triad.

灾难恢复是在重大故障后恢复系统和数据的过程。它包括制定成文的计划、确定关键操作的优先级，并定期演练恢复程序。该主题与 CIA 三元组中的可用性相关。

Published by TutorHao | GCSE CCEA Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）

GCSE CCEA Computer Science: Cyber Security | GCSE CCEA 计算机：网络安全 考点精讲