Cybersecurity | 网络安全

📚 Cybersecurity | 网络安全

Cybersecurity is the practice of protecting computer systems, networks, and data from digital attacks, theft, and damage. In the modern world, almost every aspect of our lives relies on digital technology, making strong cyber defences essential. This guide covers the key concepts required for the AQA GCSE Computer Science syllabus, including forms of attack, social engineering, malware, and methods of defence such as firewalls, encryption, and penetration testing.

网络安全是保护计算机系统、网络和数据免受数字攻击、盗窃和破坏的实践。在现代社会，我们生活的方方面面几乎都依赖数字技术，因此强大的网络防御至关重要。本指南涵盖了AQA GCSE计算机科学教学大纲所需的关键概念，包括攻击形式、社会工程、恶意软件以及防火墙、加密和渗透测试等防御方法。

1. Forms of Attack | 攻击形式

A cyber attack is any attempt to gain unauthorised access to a computer system or network with the intention of causing damage, stealing data, or disrupting services. Attacks can be passive, such as eavesdropping on network traffic, or active, such as modifying data or launching malware.

网络攻击是指任何试图未经授权访问计算机系统或网络，意图造成破坏、窃取数据或中断服务的行为。攻击可以是被动的，例如窃听网络流量；也可以是主动的，例如修改数据或投放恶意软件。

Common forms of active attack include denial-of-service (DoS) attacks, where a system is flooded with traffic to make it unavailable, and man-in-the-middle attacks, where an attacker intercepts and possibly alters communications between two parties. Passive attacks, like packet sniffing, simply monitor data without altering it, making them harder to detect.

常见的主动攻击形式包括拒绝服务攻击（DoS），通过大量流量淹没系统使其不可用；以及中间人攻击，攻击者拦截并可能篡改双方之间的通信。被动攻击，如数据包嗅探，只是监控数据而不进行修改，因此更难被发现。

An insider attack occurs when someone within an organisation misuses their authorised access to cause harm. Attacks may be targeted at specific organisations (targeted attacks) or spread widely to catch many victims (untargeted attacks).

内部攻击是指组织内部人员滥用其授权访问造成危害。攻击可以是针对特定组织的（定向攻击），也可以大范围传播以捕获众多受害者（非定向攻击）。

2. Malware | 恶意软件

Malware, short for malicious software, is any program designed to infiltrate or damage a computer system without the user’s consent. The AQA specification expects you to know several types: viruses, worms, Trojans, ransomware, spyware, and adware.

恶意软件（Malware）是恶意软件的缩写，指任何意图在未经用户同意的情况下潜入或破坏计算机系统的程序。AQA规范要求你了解以下几种类型：病毒、蠕虫、特洛伊木马、勒索软件、间谍软件和广告软件。

A virus attaches itself to a legitimate program or file and spreads when that file is shared. It requires human action, such as opening an infected email attachment, to activate. A worm, by contrast, can replicate itself and spread across networks without any user interaction, exploiting security holes in operating systems.

病毒会附着在合法程序或文件上，并在文件被共享时传播。它需要人为操作才能激活，例如打开受感染的电子邮件附件。相比之下，蠕虫可以自我复制并在网络上传播，无需任何用户交互，它利用操作系统的安全漏洞。

A Trojan horse masquerades as a useful or interesting application but carries a hidden destructive function. Once installed, it can create backdoors, steal data, or install other malware. Ransomware encrypts a victim’s files and demands payment for the decryption key. Spyware secretly monitors user activity and collects personal information, while adware automatically displays unwanted advertisements, often bundled with free software.

特洛伊木马伪装成有用或有趣的应用程序，但暗藏破坏功能。一旦安装，它可以创建后门、窃取数据或安装其他恶意软件。勒索软件会加密受害者的文件，并要求支付赎金以获取解密密钥。间谍软件秘密监控用户活动并收集个人信息，而广告软件则自动显示不需要的广告，通常与免费软件捆绑在一起。

3. Social Engineering | 社会工程学

Social engineering exploits human psychology rather than technical vulnerabilities to gain access to systems or information. Attackers manipulate people into breaking normal security procedures. Common techniques include phishing, pretexting, baiting, and quid pro quo.

社会工程学利用人类心理而非技术漏洞来获取系统或信息的访问权限。攻击者操纵人们违反常规安全程序。常见技术包括网络钓鱼、借口造谣、诱饵和等价交换。

Phishing involves sending fraudulent communications, often emails, that appear to come from a trusted source. The aim is to trick the recipient into revealing sensitive data like passwords or bank details. Spear phishing targets specific individuals with personalised messages, while whaling targets senior executives. Smishing uses SMS text messages and vishing uses voice calls.

网络钓鱼涉及发送欺诈性通信，通常是电子邮件，这些邮件看似来自可信来源。目的是诱骗收件人泄露密码或银行详细信息等敏感数据。鱼叉式网络钓鱼针对特定个人发送个性化消息，而捕鲸攻击瞄准高级管理人员。短信钓鱼使用短信，语音钓鱼使用语音电话。

Pretexting creates a fabricated scenario to obtain information; for example, an attacker might pretend to be an IT support technician who needs your password to fix an issue. Baiting offers something enticing, like a free music download, to deliver malware. Quid pro quo involves a promise of a service in exchange for information.

借口造谣编造一个虚假场景来获取信息；例如，攻击者可能冒充IT支持技术人员，称需要你的密码来解决问题。诱饵提供诱人的东西，如免费音乐下载，以传播恶意软件。等价交换涉及承诺提供某种服务以换取信息。

4. Brute-force and Denial-of-Service Attacks | 暴力破解与拒绝服务攻击

A brute-force attack is a trial-and-error method used to crack passwords or encryption keys by systematically checking all possible combinations until the correct one is found. Modern systems defend against this by limiting login attempts and introducing delays between tries, but weak or common passwords remain vulnerable.

暴力破解攻击是一种试错方法，通过系统地检查所有可能的组合来破解密码或加密密钥，直到找到正确的组合为止。现代系统通过限制登录尝试次数和在尝试之间引入延迟来防御此类攻击，但弱密码或常见密码仍然容易受到攻击。

A denial-of-service (DoS) attack aims to shut down a machine or network by overwhelming it with traffic. A distributed denial-of-service (DDoS) attack uses many compromised computers, often part of a botnet, to launch the attack simultaneously from multiple sources, making it much harder to block. Such attacks disrupt availability, one of the three key security principles.

拒绝服务攻击（DoS）旨在通过大量流量淹没计算机或网络，使其关闭。分布式拒绝服务攻击（DDoS）使用许多受感染的计算机（通常是僵尸网络的一部分）从多个来源同时发起攻击，使其更难以阻断。此类攻击会破坏可用性，这是三个关键安全原则之一。

5. SQL Injection and Other Exploits | SQL注入及其他漏洞利用

SQL injection is a code injection technique that exploits vulnerabilities in a website’s database layer. An attacker enters a specially crafted SQL statement into an input field, such as a login form, to manipulate the database. For example, entering ‘ OR 1=1 — could bypass authentication by making the query always return true.

SQL注入是一种代码注入技术，它利用网站数据库层的漏洞。攻击者在输入字段（如登录表单）中输入特制的SQL语句来操纵数据库。例如，输入‘ OR 1=1 — 可能通过使查询始终返回真来绕过身份验证。

Other common exploits include cross-site scripting (XSS), which injects malicious scripts into trusted websites to run in a victim’s browser, and buffer overflow attacks, where excess data overwrites adjacent memory. These all fall under the category of application-layer attacks, targeting flaws in software design or implementation.

其他常见的漏洞利用包括跨站脚本攻击（XSS），它将恶意脚本注入受信任的网站并在受害者的浏览器中运行；以及缓冲区溢出攻击，其中过量的数据覆盖相邻内存。这些都属于应用层攻击，针对软件设计或实现中的缺陷。

6. Detection and Prevention | 检测与预防

Organisations use a range of methods to detect and prevent cyber threats. Firewalls monitor and control incoming and outgoing network traffic based on predetermined security rules. They can be implemented as hardware, software, or a combination of both, and act as a barrier between a trusted internal network and untrusted external networks.

组织使用一系列方法来检测和预防网络威胁。防火墙根据预定的安全规则监控和控制进出网络流量。它们可以作为硬件、软件或两者的组合来实现，并在受信任的内部网络与不受信任的外部网络之间充当屏障。

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) monitor networks for malicious activity. An IDS alerts administrators of suspicious events, while an IPS can automatically block threats in real time. Antivirus and anti-malware software scan files and programs for known signatures and use heuristics to identify new threats.

入侵检测系统（IDS）和入侵防御系统（IPS）监控网络中的恶意活动。IDS会提醒管理员可疑事件，而IPS可以实时自动阻止威胁。防病毒和反恶意软件扫描文件和程序以查找已知特征码，并使用启发式方法来识别新威胁。

Regular software updates and patch management close security vulnerabilities that could be exploited. Secure configuration involves turning off unnecessary services, changing default passwords, and enforcing the principle of least privilege, so users only have the access they need to perform their job.

定期的软件更新和补丁管理可以关闭可能被利用的安全漏洞。安全配置包括关闭不必要的服务、更改默认密码以及执行最小权限原则，使用户只拥有完成工作所需的访问权限。

7. Encryption | 加密

Encryption is the process of converting plaintext into ciphertext to prevent unauthorised access. The original message is transformed using an algorithm and a key. Only someone with the correct key can decrypt the ciphertext back into readable plaintext.

加密是将明文转换为密文以防止未经授权访问的过程。原始信息使用算法和密钥进行转换。只有拥有正确密钥的人才能将密文解密为可读的明文。

Symmetric encryption uses the same key for both encryption and decryption. It is fast and suitable for encrypting large amounts of data, but the key must be shared securely. Asymmetric encryption uses a pair of keys: a public key to encrypt data and a private key to decrypt it. This solves the key distribution problem and is used in SSL/TLS to secure web traffic.

对称加密使用相同的密钥进行加密和解密。它速度快，适合加密大量数据，但必须安全地共享密钥。非对称加密使用一对密钥：公钥用于加密数据，私钥用于解密数据。这解决了密钥分发问题，并用于SSL/TLS以保护网络流量。

Encryption protects data both in transit (e.g. during online banking) and at rest (e.g. on a stolen laptop). Modern encryption standards, such as AES, are considered unbreakable with current technology if implemented correctly.

加密保护传输中的数据（例如在线银行期间）和静止数据（例如在失窃的笔记本电脑上）。现代加密标准（如AES）在正确实施的情况下，使用当前技术被认为是无法破解的。

8. Penetration Testing and Ethical Hacking | 渗透测试与道德黑客

Penetration testing (pen testing) simulates a cyber attack on a computer system to identify vulnerabilities that could be exploited by malicious hackers. It is authorised and performed by security professionals known as ethical hackers.

渗透测试（pen testing）模拟对计算机系统的网络攻击，以识别可能被恶意黑客利用的漏洞。它是经授权的，由被称为道德黑客的安全专业人员执行。

A pen test can be black-box, where the tester has no prior knowledge of the system, white-box, where full internal documentation is provided, or grey-box, which is a combination. The goal is to find weaknesses in networks, applications, and human processes before real attackers do.

渗透测试可以是黑盒测试，测试人员对系统没有任何先验知识；白盒测试，提供完整的内部文档；或灰盒测试，这是两者的结合。目标是在真正的攻击者之前发现网络、应用程序和人为过程中的弱点。

After testing, a detailed report is produced outlining the vulnerabilities found, the methods used, and recommendations for remediation. This helps organisations strengthen their security posture by addressing the root causes of potential breaches.

测试后，会生成一份详细报告，概述发现的漏洞、使用的方法以及补救建议。这有助于组织通过解决潜在泄露的根本原因来加强其安全态势。

9. Biometrics and Access Control | 生物识别与访问控制

Biometric security measures use unique physical or behavioural characteristics to verify a person’s identity. Common examples include fingerprint scanning, facial recognition, iris or retinal scanning, and voice recognition. Because these traits are extremely difficult to forge or steal, biometrics offers a strong form of authentication.

生物识别安全措施利用独特的物理或行为特征来验证个人身份。常见的例子包括指纹扫描、面部识别、虹膜或视网膜扫描以及语音识别。由于这些特征极难伪造或窃取，生物识别提供了一种强大的身份验证形式。

Access control policies determine who is allowed to access what resources. Multi-factor authentication (MFA) combines two or more independent credentials: something you know (a password), something you have (a security token), and something you are (a biometric). This drastically reduces the risk of unauthorised access even if one factor is compromised.

访问控制策略决定了谁可以访问哪些资源。多因素身份验证（MFA）结合了两个或多个独立的凭据：你知道的东西（密码）、你拥有的东西（安全令牌）以及你是什么（生物识别）。这大大降低了即使一个因素被泄露也导致未经授权访问的风险。

10. Security Policies and User Awareness | 安全策略与用户意识

Technology alone cannot guarantee security. Organisations must establish clear security policies that define acceptable use of systems, password complexity requirements, incident response procedures, and data handling rules. These policies are often enforced through user agreements and disciplinary measures.

仅靠技术无法保证安全。组织必须建立明确的安全策略，定义系统的可接受使用、密码复杂性要求、事件响应程序以及数据处理规则。这些策略通常通过用户协议和纪律措施来执行。

User training and awareness programmes are vital because many successful attacks exploit human error. Employees should be taught to recognise phishing emails, avoid clicking suspicious links, and report security incidents promptly. Regular simulated phishing exercises can reinforce this learning.

用户培训和安全意识教育至关重要，因为许多成功的攻击都利用了人为错误。应教导员工识别网络钓鱼邮件、避免点击可疑链接并立即报告安全事件。定期的模拟钓鱼演习可以巩固这种学习。

Physical security is also part of cybersecurity. Locking server rooms, using shredders for confidential documents, and requiring ID badges prevent unauthorised physical access that could lead to data theft or network breaches.

物理安全也是网络安全的一部分。锁定服务器机房、使用碎纸机处理机密文件以及要求佩戴身份证件，可以防止可能导致数据盗窃或网络入侵的未经授权的物理访问。

11. The Three Core Principles: CIA Triad | 三个核心原则：CIA三元组

Information security is commonly described using the CIA triad: Confidentiality, Integrity, and Availability. Confidentiality ensures that data is accessible only to those authorised to view it. Encryption and access controls are key mechanisms to maintain confidentiality.

信息安全通常使用CIA三元组来描述：机密性、完整性和可用性。机密性确保数据仅可由已授权查看的人访问。加密和访问控制是维护机密性的关键机制。

Integrity ensures that data remains accurate, consistent, and unaltered by unauthorised parties. Hashing, checksums, and version control help detect and prevent unauthorised changes. Availability means that systems and data are accessible when needed by authorised users. Redundancy, failover, and DDoS protection are measures to uphold availability.

完整性确保数据保持准确、一致，且未被未经授权方修改。哈希、校验和和版本控制有助于检测和防止未经授权的更改。可用性意味着系统和数据在授权用户需要时可以访问。冗余、故障切换和DDoS防护是维护可用性的措施。

12. Revision Summary and Exam Tips | 复习总结与考试技巧

The AQA GCSE exam may ask you to identify types of malware or social engineering from a scenario, explain how a particular security measure works, or evaluate the effectiveness of a security strategy. Use precise technical vocabulary and always link the threat to the defence mechanism.

AQA GCSE考试可能要求你根据场景识别恶意软件或社会工程学的类型，解释特定安全措施的工作原理，或评估安全策略的有效性。使用精确的技术词汇，始终将威胁与防御机制联系起来。

When discussing encryption, remember the difference between symmetric and asymmetric, and give an example use. For penetration testing, clarify that it is authorised and aims to identify and fix vulnerabilities. Always refer back to the CIA triad when discussing impact: does the attack breach confidentiality, integrity, or availability?

在讨论加密时，记住对称加密和非对称加密的区别，并给出示例用途。对于渗透测试，阐明它是经授权的，旨在识别和修复漏洞。在讨论影响时，始终参考CIA三元组：攻击是否违反了机密性、完整性或可用性？

Practice defining keywords such as firewall, brute-force, SQL injection, and phishing. You may be asked to recommend suitable security measures for a given situation, so think about layering defences: a combination of technical controls, policies, and user training is usually the strongest approach.

练习定义关键词，如防火墙、暴力破解、SQL注入和网络钓鱼。你可能会被要求针对特定情况推荐合适的安全措施，因此考虑分层防御：技术控制、策略和用户培训的组合通常是最强有力的方法。

Published by TutorHao | Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）

Cybersecurity | 网络安全