📚 Cybersecurity: Threats, Prevention and Encryption | 网络安全：威胁、防护与加密
Cybersecurity is the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. For IB and AQA Computer Science students, understanding the landscape of cyber threats and the measures used to counteract them is essential. This article covers the key concepts, from common attack vectors to encryption and secure network design.
网络安全是保护计算机、服务器、移动设备、电子系统、网络和数据免受恶意攻击的实践。对于 IB 和 AQA 计算机科学学生而言，理解网络威胁的全貌及用于对抗这些威胁的措施至关重要。本文涵盖从常见攻击手段到加密与安全网络设计的关键概念。
1. Introduction to Cybersecurity | 网络安全概述
In the digital age, information is one of the most valuable assets. Cybersecurity combines technology, processes, and practices to prevent unauthorised access, alteration, or destruction of data. The CIA triad — Confidentiality, Integrity, and Availability — forms the foundation of all security strategies. Confidentiality ensures data is only accessible to authorised users; integrity guarantees the accuracy and trustworthiness of data; availability ensures that systems and data are accessible when needed.
在数字时代，信息是最宝贵的资产之一。网络安全结合了技术、流程和实践，以防止未经授权的访问、修改或破坏数据。CIA 三元组 — 保密性、完整性和可用性 — 构成所有安全策略的基础。保密性确保数据仅对授权用户可用；完整性保证数据的准确性与可信度；可用性确保系统和数据在需要时可访问。
2. Common Cyber Threats | 常见网络威胁
A threat is any potential danger to information or systems. The most prevalent threats include malware, social engineering, denial-of-service attacks, man-in-the-middle attacks, and SQL injection. Each category exploits different vulnerabilities, and effective defence requires a layered approach. Understanding how these threats operate is the first step to building robust countermeasures.
威胁是针对信息或系统的任何潜在危险。最常见的威胁包括恶意软件、社交工程、拒绝服务攻击、中间人攻击和 SQL 注入。每个类别利用不同的漏洞，有效的防御需要分层方法。理解这些威胁如何运作是建立强健对策的第一步。
3. Malware: Viruses, Worms, Trojans and Ransomware | 恶意软件：病毒、蠕虫、木马与勒索软件
Malware, short for malicious software, is designed to damage or disable computers. A virus attaches itself to clean files and spreads through user action, such as opening an infected attachment. A worm replicates itself across networks without user intervention, often consuming bandwidth. A Trojan horse disguises itself as legitimate software but carries a harmful payload. Ransomware encrypts the victim’s files and demands payment for the decryption key. The rise of ransomware-as-a-service has made these attacks more frequent.
恶意软件即便携恶意软件，旨在破坏或禁用计算机。病毒将自身附着于干净文件并通过用户操作传播，例如打开受感染的附件。蠕虫无需用户干预即可在网络中自我复制，经常消耗带宽。特洛伊木马伪装成合法软件但携带有害负载。勒索软件加密受害者的文件并要求支付赎金以获取解密密钥。勒索软件即服务的兴起使这类攻击更加频繁。
4. Social Engineering Attacks | 社交工程攻击
Social engineering exploits human psychology rather than technical vulnerabilities. Phishing is the most common form, where attackers send deceptive emails or messages that appear to come from trusted sources to trick recipients into revealing sensitive information or installing malware. Spear phishing targets specific individuals or organisations. Pretexting involves creating a fabricated scenario to obtain information. Baiting offers something enticing, like a free download, to infect a system. Awareness training is the primary defence against these attacks.
社交工程利用人的心理而非技术漏洞。网络钓鱼是最常见的形式，攻击者发送看似来自可信任来源的欺骗性电子邮件或消息，诱骗收件人泄露敏感信息或安装恶意软件。鱼叉式网络钓鱼针对特定的个人或组织。假托涉及编造情景以获取信息。诱饵提供吸引人的东西，如免费下载，以感染系统。安全意识培训是防御此类攻击的主要手段。
5. Denial of Service (DoS) and DDoS Attacks | 拒绝服务 (DoS) 与分布式拒绝服务 (DDoS) 攻击
A Denial of Service attack aims to make a machine or network resource unavailable by overwhelming it with traffic. In a Distributed DoS attack, the traffic originates from many compromised systems, often a botnet. This floods the target’s bandwidth or exhausts its computing resources, causing legitimate requests to be denied. Mitigation techniques include traffic filtering, rate limiting, and using Content Delivery Networks that can absorb large volumes of traffic.
拒绝服务攻击旨在通过使流量过载来使机器或网络资源不可用。在分布式 DoS 攻击中，流量源自许多受感染系统，通常为僵尸网络。这会淹没目标的带宽或耗尽计算资源，导致合法请求被拒绝。缓解技术包括流量过滤、速率限制和使用能吸收大量流量的内容分发网络。
6. Network Security Measures: Firewalls and IDS/IPS | 网络安全措施：防火墙与入侵检测/防护系统
Firewalls act as a barrier between trusted internal networks and untrusted external networks, filtering incoming and outgoing traffic based on predefined rules. They can be hardware, software, or a combination. Intrusion Detection Systems (IDS) monitor network traffic for suspicious activity and alert administrators, while Intrusion Prevention Systems (IPS) can automatically block threats in real time. Together, they form a critical perimeter defence.
防火墙充当可信内部网络与不可信外部网络之间的屏障，根据预定义规则过滤进出流量。它们可以是硬件、软件或两者的结合。入侵检测系统 (IDS) 监控网络流量中的可疑活动并警告管理员，而入侵防护系统 (IPS) 可以实时自动阻止威胁。它们共同形成关键的边界防御。
7. Encryption and Cryptography | 加密与密码学
Encryption converts plaintext into ciphertext using an algorithm and a key, ensuring that only authorised parties can read the original data. Cryptography is the broader science of securing communication. The strength of encryption depends on the algorithm and key length. Common symmetric algorithms include AES and DES; asymmetric algorithms include RSA and ECC. Modern protocols like TLS use a combination of both to secure web traffic.
加密使用算法和密钥将明文转换为密文，确保只有授权方可以读取原始数据。密码学是保护通信的更广泛科学。加密强度取决于算法和密钥长度。常见的对称算法包括 AES 和 DES；非对称算法包括 RSA 和 ECC。TLS 等现代协议结合使用两者来保护网络流量。
8. Symmetric vs Asymmetric Encryption | 对称加密与非对称加密对比
| Feature | 特征 | Symmetric | 对称加密 | Asymmetric | 非对称加密 |
|---|---|---|
| Keys | 密钥 | Single shared key | 单一共享密钥 | Public and private key pair | 公钥和私钥对 |
| Speed | 速度 | Fast, efficient | 快速、高效 | Slower, computationally intensive | 较慢，计算密集 |
| Key distribution | 密钥分发 | Problematic; secure channel needed | 困难，需要安全通道 | Public key can be openly shared | 公钥可公开共享 |
| Use cases | 使用场景 | Bulk data encryption, file storage | 大量数据加密、文件存储 | Key exchange, digital signatures, SSL/TLS handshake | 密钥交换、数字签名、SSL/TLS 握手 |
In practice, a hybrid approach is used: asymmetric encryption secures the key exchange to establish a symmetric session key, which then encrypts the actual data. This combines the security benefits of asymmetric cryptography with the performance of symmetric algorithms.
实践中采用混合方法：用非对称加密保护密钥交换以建立对称会话密钥，然后由对称密钥加密实际数据。这结合了非对称密码学的安全优势与对称算法的性能优势。
9. Digital Signatures and Certificates | 数字签名与证书
A digital signature provides authentication, integrity, and non-repudiation. The sender creates a hash of the message and encrypts it with their private key. The recipient decrypts the hash with the sender’s public key and compares it to a freshly computed hash of the message. If they match, the message is intact and genuinely from the sender. Digital certificates, issued by Certificate Authorities (CAs), bind a public key to an entity’s identity, establishing trust in online communications.
数字签名提供身份验证、完整性和不可否认性。发送方创建消息的哈希并用私钥加密。接收方用发送方的公钥解密哈希，并将其与消息的新计算哈希进行比较。如果匹配，则消息完整且确实来自发送方。数字证书由证书颁发机构 (CA) 颁发，将公钥绑定到实体身份，从而在网络通信中建立信任。
10. Access Control and Authentication | 访问控制与身份认证
Access control ensures that only authorised individuals can view or use resources. Authentication verifies a user’s identity through something they know (password), something they have (smart card), or something they are (biometrics). Multi-factor authentication (MFA) combines two or more factors for stronger security. Once authenticated, authorisation determines what a user is allowed to do. The principle of least privilege limits users to only the permissions necessary for their tasks.
访问控制确保只有授权人员可以查看或使用资源。身份认证通过用户所知（密码）、所有（智能卡）或所是（生物特征）来验证用户身份。多因素认证 (MFA) 结合两种或更多因素以实现更强安全性。认证后，授权确定允许用户执行的操作。最小权限原则将用户限制为仅执行任务所需的权限。
11. Security Policies and User Training | 安全策略与用户培训
Technical measures alone are insufficient. Organisations must establish clear security policies that define acceptable use, password requirements, incident response procedures, and data classification. Regular user training is critical because employees are often the weakest link. Training programmes should cover recognising phishing, safe browsing habits, physical security, and the importance of reporting suspicious activity. A well-informed workforce dramatically reduces the risk of a successful attack.
仅靠技术措施是不够的。组织必须制定清晰的安全策略，定义可接受使用、密码要求、事件响应程序和数据分类。定期用户培训至关重要，因为员工往往是最薄弱的环节。培训项目应涵盖识别网络钓鱼、安全浏览习惯、物理安全及报告可疑活动的重要性。一个受过良好教育的员工队伍会显著降低成功攻击的风险。
12. Ethical Hacking and Penetration Testing | 伦理黑客与渗透测试
Ethical hacking involves simulating cyberattacks on a system to identify vulnerabilities before malicious hackers can exploit them. Penetration testing follows a structured methodology: reconnaissance, scanning, gaining access, maintaining access, and covering tracks. White-hat hackers use the same tools as black-hat hackers but with permission and for defensive purposes. The results help organisations patch weaknesses and strengthen their overall security posture.
伦理黑客涉及模拟对系统的网络攻击，以便在恶意黑客利用之前发现漏洞。渗透测试遵循结构化方法论：侦察、扫描、获取访问、维持访问和掩盖痕迹。白帽黑客使用与黑帽黑客相同的工具，但经授权且出于防御目的。测试结果帮助组织修补弱点并加强整体安全态势。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导