📚 A-Level OCR Computer Science: Network Security Key Revision Guide | A-Level OCR 计算机：网络安全考点精讲
In an era where almost every business, school, and individual relies on digital networks, understanding network security is no longer a niche topic for IT specialists – it is an essential part of A-Level Computer Science. OCR’s specification requires you to identify threats, explain how they compromise systems, and evaluate the effectiveness of countermeasures. This guide distils the core concepts into accessible, bilingual explanations, helping you master both the theoretical principles and the practical reasoning needed for exam success.
在当今几乎每个企业、学校和个体都依赖数字网络的时代，理解网络安全已不再是 IT 专家的专属话题——它是 A-Level 计算机科学不可或缺的部分。OCR 考试大纲要求你识别威胁、解释它们如何危害系统，并评估应对措施的有效性。这篇指南将核心概念提炼为通俗易懂的双语解释，帮助你掌握必要的理论原理与实践推理，顺利应对考试。
1. What is Network Security? | 什么是网络安全？
Network security refers to the policies, practices, and technologies adopted to prevent and monitor unauthorised access, misuse, modification, or denial of a computer network and its resources. It involves protecting the confidentiality, integrity, and availability of data – often called the CIA triad.
网络安全指为防止和监控对计算机网络及其资源的未授权访问、滥用、篡改或拒绝服务而采取的政策、实践和技术。它涉及保护数据的机密性、完整性和可用性——通常称为 CIA 三元组。
Confidentiality ensures that information is only accessible to authorised users. Integrity guarantees data has not been tampered with during storage or transmission. Availability means that network services and data are accessible when needed by legitimate users. These three objectives guide every security measure you will study.
机密性确保信息只能由授权用户访问。完整性保证数据在存储或传输过程中未被篡改。可用性意味着网络服务和数据在合法用户需要时可以被访问。这三个目标贯穿了你将学习的每一项安全措施。
2. Common Threats: Malware | 常见威胁：恶意软件
Malware, short for malicious software, is any program intentionally designed to disrupt, damage, or gain unauthorised access to a computer system. It can spread through email attachments, infected websites, removable media, or network vulnerabilities.
恶意软件（malware）是恶意软件的缩写，指任何旨在故意破坏、损坏或未经授权访问计算机系统的程序。它可以通过电子邮件附件、受感染的网站、可移动介质或网络漏洞传播。
A virus attaches itself to a legitimate program or file and requires user action to spread. A worm, by contrast, self-replicates across networks without needing a host file. A Trojan horse disguises itself as genuine software while secretly performing malicious activities. Ransomware encrypts a victim’s files and demands payment for the decryption key. Spyware covertly monitors user activity and harvests sensitive information.
病毒将自己附着在合法程序或文件上，需要用户操作才能传播。蠕虫则相反，它无需宿主文件即可在网络上自我复制。特洛伊木马伪装成正常软件，偷偷执行恶意活动。勒索软件会加密受害者的文件，并要求支付赎金以获取解密密钥。间谍软件则暗中监视用户活动并收集敏感信息。
3. Social Engineering | 社会工程学
Social engineering exploits human psychology rather than technical weaknesses. Attackers manipulate individuals into divulging confidential information or performing actions that compromise security. It is often the weakest link in a system’s defence.
社会工程学利用的是人类心理而非技术漏洞。攻击者操纵个体泄露机密信息或执行危害安全的操作。它往往是系统防御中最薄弱的环节。
Pretexting involves creating a fabricated scenario to trick a victim into giving away data. Baiting uses a false promise to arouse curiosity or greed, such as leaving an infected USB stick in a car park labelled ‘salary details’. Shoulder surfing simply means looking over someone’s shoulder to observe their screen or keyboard. Tailgating occurs when an unauthorised person follows an employee through a secure door without authenticating themselves. Awareness training is a critical countermeasure against all forms of social engineering.
假托（Pretexting）指编造一个场景诱骗受害者交出数据。利诱（Baiting）利用虚假承诺激发好奇心或贪念，例如在停车场留下一个标注着“工资详情”的受感染 U 盘。肩窥就是越过他人的肩膀偷看屏幕或键盘。尾随是指未经授权者跟在员工身后进入安全门而未进行身份验证。防范所有形式的社会工程攻击，关键对策是安全意识培训。
4. Phishing and Pharming | 网络钓鱼与域名欺诈
Phishing is a form of social engineering that typically uses fraudulent emails or messages that appear to come from a trusted source. These messages direct recipients to fake websites designed to steal login credentials, banking details, or personal data.
网络钓鱼是社会工程学的一种形式，通常使用看似来自可信来源的欺诈性电子邮件或消息。这些消息引导收件人访问旨在窃取登录凭证、银行信息或个人数据的虚假网站。
Spear phishing targets a specific individual or organisation, often using personal details to appear more convincing. Pharming is a more technical attack: it redirects a legitimate website’s traffic to a fraudulent site without the user’s knowledge, often by compromising DNS servers or altering host files on a computer. Countermeasures include carefully checking URLs, multi-factor authentication, and anti-phishing toolbars in browsers.
鱼叉式网络钓鱼针对特定个人或组织，通常利用个人详细信息以显得更具说服力。域名欺诈（Pharming）是一种技术性更强的攻击：它在用户不知情的情况下将合法网站的流量重定向到虚假站点，通常通过攻破 DNS 服务器或篡改计算机上的 hosts 文件实现。防范措施包括仔细检查网址、多因素认证以及浏览器中的反钓鱼工具栏。
5. Denial of Service (DoS) and Distributed DoS Attacks | 拒绝服务攻击与分布式拒绝服务攻击
A Denial of Service (DoS) attack aims to overwhelm a network or server with a flood of traffic, rendering it unavailable to legitimate users. The attacker typically exploits protocol weaknesses or sends malformed requests that consume system resources.
拒绝服务攻击旨在用大量流量淹没网络或服务器，使其无法为合法用户提供服务。攻击者通常利用协议漏洞或发送格式异常的请求来消耗系统资源。
In a Distributed Denial of Service (DDoS) attack, multiple compromised devices – often part of a botnet – launch a coordinated flood of requests from different locations. This makes the attack far harder to mitigate by simply blocking a single IP address. Common motives include extortion, hacktivism, or simply causing disruption. Defences include traffic filtering, rate limiting, and using Content Delivery Networks to absorb surges.
在分布式拒绝服务攻击中，多台受感染的设备——通常是僵尸网络的一部分——从不同地点发起协同的请求洪流。这使得仅通过封锁单个 IP 地址来缓解攻击变得极其困难。常见动机包括敲诈勒索、黑客行动主义或单纯的破坏。防御措施包括流量过滤、速率限制以及使用内容分发网络来吸收突发流量。
6. Data Interception and Theft | 数据拦截与窃取
Data interception occurs when an unauthorised party captures data as it travels across a network. Without adequate protection, login credentials, financial transactions, or personal communications can be read, copied, or modified in transit.
数据拦截是指未经授权的第三方在网络传输过程中捕获数据。如果没有足够的保护，登录凭证、金融交易或个人通信就可能被读取、复制或篡改。
Packet sniffers are tools that monitor and capture data packets on a network. If data is sent in plaintext, a sniffer can reveal sensitive information immediately. Encryption is the primary defence: even if packets are intercepted, the ciphertext cannot be read without the correct decryption key. Virtual Private Networks (VPNs) also create secure, encrypted tunnels over public networks, protecting data from eavesdroppers.
数据包嗅探器是监视并捕获网络上数据包的工具。如果数据以明文发送，嗅探器可以立即披露敏感信息。加密是首要防御手段：即使数据包被拦截，没有正确的解密密钥也无法读取密文。虚拟专用网络（VPN）还能在公共网络上建立安全的加密隧道，保护数据免受窃听。
7. Encryption and Secure Protocols | 加密与安全协议
Encryption transforms readable plaintext into unintelligible ciphertext using an algorithm and a key. Symmetric encryption uses the same key for both encryption and decryption, while asymmetric encryption uses a pair of mathematically related keys: a public key and a private key.
加密使用算法和密钥将可读的明文转换为无法理解的密文。对称加密使用同一把密钥进行加密和解密，而非对称加密则使用一对数学关联的密钥：公钥和私钥。
Common symmetric algorithms include AES (Advanced Encryption Standard), which can use key lengths of 128, 192, or 256 bits. Asymmetric encryption, such as RSA, is computationally heavier but solves the problem of securely exchanging keys. In practice, a hybrid approach is used: SSL/TLS protocols employ asymmetric encryption to share a symmetric session key, then switch to faster symmetric encryption for the bulk of the data transfer. HTTPS relies on TLS to secure web traffic.
常见的对称算法包括 AES（高级加密标准），其密钥长度可为 128、192 或 256 位。非对称加密如 RSA 计算量较大，但解决了安全交换密钥的难题。实践中采用混合方式：SSL/TLS 协议利用非对称加密来共享对称会话密钥，随后切换到速率更快的对称加密进行主体数据传输。HTTPS 依靠 TLS 来保护网络通信。
8. Firewalls | 防火墙
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules. It sits at the boundary between a trusted internal network and an untrusted external network, such as the Internet, acting as a barrier.
防火墙是一种网络安全系统，根据预设的安全规则监控并控制进出流量。它位于可信内部网络与不可信外部网络（如互联网）之间的边界上，充当屏障。
Firewalls can be hardware appliances or software applications. They filter packets by examining source and destination IP addresses, port numbers, and protocols. Stateful inspection firewalls go further by tracking the state of active connections and making decisions based on the context of the traffic. Proxy firewalls act as intermediaries, fetching data on behalf of clients and hiding internal network addresses. Firewalls cannot stop all threats – they need to be combined with other measures such as intrusion detection systems and user training.
防火墙可以是硬件设备，也可以是软件应用。它们通过检查源和目标 IP 地址、端口号以及协议来过滤数据包。状态检测防火墙更进一步，它跟踪活动连接的状态，并根据流量上下文做出决策。代理防火墙则充当中介，代表客户端获取数据并隐藏内部网络地址。防火墙无法阻止所有威胁——它们需要与入侵检测系统和用户培训等其他措施配合使用。
9. User Access Levels and Authentication | 用户访问级别与认证
Controlling who can access what is fundamental to network security. User access levels ensure that individuals have permission to read, write, or execute only the files and resources necessary for their role – this is known as the principle of least privilege.
控制谁能访问什么是网络安全的基础。用户访问级别确保个人仅拥有其角色所需的文件与资源的读取、写入或执行权限——这称为最小权限原则。
Authentication verifies a user’s identity. Single-factor authentication relies on something the user knows, such as a password. Multi-factor authentication (MFA) combines two or more independent categories: something you know (password), something you have (security token or mobile device), and something you are (biometric data). Strong password policies – minimum length, complexity requirements, and regular expiry – reduce the risk of brute-force attacks. Biometric methods such as fingerprint or iris scans add another layer of security but raise privacy concerns.
认证负责验证用户身份。单因素认证依赖用户所知，例如密码。多因素认证结合两种或更多独立类别：你所知道的（密码）、你所拥有的（安全令牌或移动设备），以及你所是的（生物特征数据）。强密码策略——最小长度、复杂性要求以及定期过期——可降低暴力破解攻击的风险。指纹或虹膜扫描等生物识别方法增加了另一层安全，但也引发了隐私担忧。
10. Network Policies and Physical Security | 网络策略与物理安全
Technical safeguards must be supported by clear organisational policies and physical controls. An Acceptable Use Policy defines how users may or may not use the network and company equipment. A disaster recovery plan outlines procedures for restoring data and services after a breach or failure.
技术防护必须有明确的组织策略和物理控制作为支撑。可接受使用政策（Acceptable Use Policy）定义了用户可以使用或不得使用网络及公司设备的方式。灾难恢复计划概述了在遭受入侵或发生故障后恢复数据和服务的流程。
Backups are an essential defence against data loss from malware, hardware failure, or natural disasters. Common backup strategies follow the 3-2-1 rule: three copies of data, on two different media, with one copy stored off-site. Physical security measures include locked server rooms, surveillance cameras, and biometric access controls that prevent unauthorised individuals from physically tampering with hardware. These measures are often overlooked but are just as critical as software defences.
备份是应对恶意软件、硬件故障或自然灾害导致数据丢失的关键防线。常见的备份策略遵循 3-2-1 规则：数据保留三份副本，使用两种不同介质，其中一份异地存放。物理安全措施包括上锁的服务器机房、监控摄像头以及防止未经授权人员物理接触硬件的生物识别门禁。这些措施常被忽视，但与软件防御同样至关重要。
11. SQL Injection and Code Vulnerabilities | SQL 注入与代码漏洞
SQL injection is an attack technique that exploits poor input validation in web applications. An attacker inserts malicious SQL statements into an entry field, such as a login form, hoping the database server will execute them. This can lead to unauthorised data exposure, modification, or even deletion of entire tables.
SQL 注入是一种利用 Web 应用程序中糟糕的输入验证的攻击技术。攻击者将恶意的 SQL 语句插入到一个输入字段（例如登录表单）中，期望数据库服务器会执行它们。这可能导致未授权的数据泄露、修改，甚至整张表的删除。
Consider a query constructed by concatenating user input directly:
SELECT * FROM users WHERE username = ‘input’ AND password = ‘input’;
A malicious input such as ' OR '1'='1 could alter the logic and grant access without a valid password. Parameterised queries and input sanitisation are the standard defences. Developers should also follow secure coding practices and perform regular code reviews to minimise vulnerabilities.
考虑一个通过直接拼接用户输入构造的查询：
SELECT * FROM users WHERE username = ‘input’ AND password = ‘input’;
恶意输入如 ' OR '1'='1 可以改变逻辑，无需有效密码即可获得访问权限。参数化查询和输入清理是标准防御措施。开发人员还应遵循安全编码实践并定期进行代码审查，以尽量减少漏洞。
12. Evaluating Security Measures and Exam Focus | 安全措施评估与考试重点
In OCR exam questions, you will often be asked to discuss the effectiveness of security measures for a given scenario. Always consider the balance between security, usability, and cost. Overly restrictive policies may hamper productivity, while cheap solutions may leave critical gaps.
在 OCR 考试题目中，你经常会被要求针对给定场景讨论安全措施的有效性。务必考虑安全性、可用性和成本之间的平衡。过于严苛的策略可能妨碍工作效率，而廉价的解决方案可能留下严重漏洞。
Be prepared to explain how specific technologies work – for example, how a firewall uses packet filtering, or how SSL/TLS encrypts a session. Link threats to appropriate countermeasures: phishing needs user education and email filters; a DDoS attack demands network-level filtering and redundancy; malware demands antivirus software and regular patches. Marks are awarded for clear, logical reasoning and precise use of terminology.
准备好解释特定技术的工作原理——例如，防火墙如何使用数据包过滤，或者 SSL/TLS 如何加密会话。将威胁与适当的对策联系起来：网络钓鱼需要用户教育和电子邮件过滤器；DDoS 攻击需要网络级过滤和冗余部署；恶意软件需要防病毒软件和定期补丁更新。清晰逻辑推理和准确的术语使用是得分关键。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导