📚 GCSE Edexcel Computer Science: Cybersecurity | GCSE Edexcel 计算机：网络安全 考点精讲
Cybersecurity is a cornerstone of modern computing, protecting systems, networks, and data from digital attacks. In the Edexcel GCSE syllabus, you need to understand a wide range of threats and the corresponding defence mechanisms that keep information safe. Mastering this topic means being able to identify how attacks occur and recommend appropriate protective measures in exam scenarios.
网络安全是现代计算的基石，保护系统、网络和数据免受数字攻击。在 Edexcel GCSE 考纲中，你需要理解各种威胁及相应的防御机制，这些机制确保了信息的安全。掌握这一主题意味着能够在考试情境中识别攻击如何发生，并推荐恰当的防护措施。
1. What is Cybersecurity? | 什么是网络安全？
Cybersecurity refers to the practice of defending computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks. It covers both hardware and software protection, as well as the policies and human behaviours that influence security.
网络安全是指保护计算机、服务器、移动设备、电子系统、网络和数据免受恶意攻击的实践。它涵盖硬件和软件保护，以及影响安全的策略和人类行为。
In the GCSE examination, you will often be asked to explain how a given threat works or to suggest methods to prevent it. A strong answer links the technical mechanism to the human or network vulnerability being exploited.
在 GCSE 考试中，你常需要解释特定威胁的运作方式，或提出预防方法。强有力的回答会将技术机制与被利用的人或网络漏洞联系起来。
2. Malware Threats | 恶意软件威胁
Malware, short for malicious software, is any program designed to harm or exploit a device or network. Viruses attach themselves to legitimate files and replicate when those files are opened. Worms self-replicate without needing a host file and spread across networks automatically.
恶意软件是旨在危害或利用设备或网络的程序的统称。病毒附着在合法文件上，并在文件打开时进行复制。蠕虫无需宿主文件即可自我复制，并自动通过网络传播。
Trojans disguise themselves as useful software but carry a hidden malicious payload. Ransomware encrypts the user’s data and demands payment to restore access. Spyware secretly monitors and collects user activity, such as keystrokes and login credentials.
木马伪装成有用的软件，但带有隐藏的恶意负载。勒索软件加密用户的数据，并要求付款以恢复访问。间谍软件秘密监控并收集用户活动，如击键和登录凭据。
Adware displays unwanted advertisements, while rootkits grant attackers privileged access to a system. Exam questions frequently ask you to distinguish between these types based on how they spread and their impact.
广告软件显示不需要的广告，而 rootkit 则赋予攻击者对系统的特权访问。考试题目经常要求你根据传播方式和影响区分这些类型。
3. Social Engineering Attacks | 社会工程攻击
Social engineering exploits human psychology rather than technical weaknesses. Phishing involves sending deceptive emails that appear to come from trusted sources, tricking recipients into revealing sensitive information or clicking malicious links.
社会工程利用人类心理而非技术弱点。网络钓鱼涉及发送看似来自可信来源的欺骗性电子邮件，诱骗收件人透露敏感信息或点击恶意链接。
Spear-phishing is a targeted version aimed at specific individuals, often using personal details to appear convincing. Vishing uses phone calls, while smishing uses text messages to achieve the same deceptive goals. Shouldering (or shoulder surfing) is simply observing someone entering a password or PIN in a public space.
鱼叉式网络钓鱼是针对特定个人的定向版本，常使用个人细节以显得可信。语音钓鱼通过电话，而短信钓鱼通过短信达到同样的欺骗目的。肩窥是在公共场所观察他人输入密码或 PIN 码。
Blagging (also called pretexting) involves inventing a scenario to persuade a victim to hand over information. In the exam, you must be able to recognise these scenarios and suggest countermeasures such as staff training and verification procedures.
冒充（也称假托）涉及编造情景以说服受害者交出信息。在考试中，你必须能够识别这些情景，并建议对策，如员工培训和验证程序。
4. Brute-Force and Denial of Service Attacks | 暴力攻击与拒绝服务攻击
A brute-force attack attempts to crack a password or encryption key by systematically trying every possible combination until the correct one is found. Automated tools can generate thousands of guesses per second, making short and simple passwords very vulnerable.
暴力攻击通过系统地尝试每一种可能的组合来破解密码或加密密钥，直到找到正确的为止。自动化工具每秒可生成数千次猜测，使得短而简单的密码非常脆弱。
A Denial of Service (DoS) attack floods a server or network with so much traffic that it cannot respond to legitimate requests. In a Distributed Denial of Service (DDoS) attack, the flood comes from many compromised devices (a botnet), making it much harder to block.
拒绝服务攻击用大量流量淹没服务器或网络，使其无法响应合法请求。在分布式拒绝服务攻击中，流量来自许多被入侵的设备（僵尸网络），使得阻断变得更加困难。
These attacks disrupt availability, one of the core principles of cybersecurity. Questions may ask you to compare these attacks or to explain why strong passwords, account lockouts, and CAPTCHAs help mitigate them.
这些攻击破坏了可用性，这是网络安全的核心原则之一。问题可能会要求你比较这些攻击，或解释为什么强密码、账户锁定和验证码有助于缓解它们。
5. Data Interception and SQL Injection | 数据拦截与 SQL 注入
Data interception occurs when an attacker captures data as it travels across a network. Man-in-the-middle (MITM) attacks involve an attacker secretly relaying and possibly altering the communication between two parties who believe they are directly communicating.
数据拦截发生在攻击者捕获通过网络传输的数据时。中间人攻击涉及攻击者秘密中继并可能篡改双方之间的通信，而双方以为他们在直接通信。
Packet sniffers can be used on unsecured Wi-Fi to capture unencrypted data, including passwords and emails. This is why using HTTPS and VPNs is critical on public networks.
数据包嗅探器可用于不安全的 Wi-Fi 上捕获未加密的数据，包括密码和电子邮件。这就是为什么在公共网络上使用 HTTPS 和 VPN 至关重要的原因。
SQL injection targets database-driven websites. An attacker inserts malicious SQL code into an input field, such as a login box. If the website does not validate inputs properly, the database executes the injected query, potentially revealing, modifying, or deleting entire data tables.
SQL 注入针对数据库驱动的网站。攻击者在输入字段（如登录框）中插入恶意 SQL 代码。如果网站没有正确验证输入，数据库就会执行注入的查询，可能泄露、修改或删除整个数据表。
Prevention includes parameterised queries, input sanitisation, and the principle of least privilege for database accounts.
预防措施包括参数化查询、输入清理和数据库账户的最小权限原则。
6. Anti-Malware and Firewalls | 反恶意软件与防火墙
Anti-malware software detects and removes malicious code. It uses signature-based detection, comparing files against a database of known malware signatures, and heuristic analysis, which identifies suspicious behaviour even if the exact malware is new.
反恶意软件检测并删除恶意代码。它使用基于特征码的检测，将文件与已知恶意软件特征码数据库进行比较，以及启发式分析，即使恶意软件是全新的，也能识别可疑行为。
Real-time scanning monitors the system continuously, while scheduled scans run at set times. It is essential to keep anti-malware updated so it can recognise the latest threats.
实时扫描持续监控系统，而计划扫描在设定时间运行。保持反恶意软件更新至关重要，以便识别最新威胁。
A firewall acts as a barrier between a trusted internal network and untrusted external networks. It inspects incoming and outgoing packets and applies predefined rules to allow or block traffic. Hardware firewalls protect entire networks; software firewalls protect individual devices.
防火墙充当可信内部网络与不可信外部网络之间的屏障。它检查传入和传出的数据包，并应用预定义的规则来允许或阻止流量。硬件防火墙保护整个网络；软件防火墙保护单个设备。
Together, anti-malware and firewalls form the first line of defence against many cyber threats.
反恶意软件和防火墙共同构成抵御许多网络威胁的第一道防线。
7. Encryption and Secure Transmission | 加密与安全传输
Encryption scrambles data into ciphertext using an algorithm and a key, so that only authorised parties with the decryption key can read it. Symmetric encryption uses the same key for both encryption and decryption, which is fast but requires secure key exchange.
加密使用算法和密钥将数据打乱成密文，只有拥有解密密钥的授权方才能读取。对称加密使用同一密钥进行加密和解密，速度快但需要安全的密钥交换。
Asymmetric encryption uses a pair of keys: a public key for encryption and a private key for decryption. This solves the key distribution problem but is computationally slower. In practice, systems like HTTPS use a combination: symmetric encryption for bulk data and asymmetric for initial key exchange.
非对称加密使用一对密钥：公钥用于加密，私钥用于解密。这解决了密钥分发问题，但计算较慢。在实践中，HTTPS 等系统结合使用：用对称加密处理大量数据，非对称加密用于初始密钥交换。
Encryption ensures confidentiality of data in transit and at rest. The exam often focuses on how SSL/TLS and HTTPS provide secure communication over the internet.
加密确保数据传输和存储时的机密性。考试常关注 SSL/TLS 和 HTTPS 如何提供互联网上的安全通信。
8. Authentication: Passwords, Biometrics and 2FA | 身份验证：密码、生物识别和双因素认证
Authentication verifies the identity of a user. Passwords are the most common method, but they must be strong: long, with a mix of uppercase, lowercase, digits and symbols. Weak passwords can be guessed, cracked by brute-force, or exposed in data breaches.
身份验证用于核实用户的身份。密码是最常见的方法，但必须强度高：长度足够，混合大写字母、小写字母、数字和符号。弱密码可能被猜到、被暴力破解或在数据泄露中暴露。
Biometric authentication uses unique physical characteristics, such as fingerprints, iris patterns, or facial recognition. Biometrics are difficult to forge but raise privacy concerns and cannot be changed if compromised.
生物识别认证使用独特的生理特征，如指纹、虹膜模式或面部识别。生物特征难以伪造，但引发隐私问题，一旦泄露就无法更改。
Two-factor authentication (2FA) requires two different types of evidence from separate categories: something you know (password), something you have (phone, token), or something you are (biometric). This significantly reduces the risk of unauthorised access even if one factor is stolen.
双因素认证需要来自不同类别的两种不同的证据：你知道的东西（密码）、你拥有的东西（手机、令牌）或你是什么（生物特征）。这大大降低了即使一个因素被盗也能防止未授权访问的风险。
9. Access Rights and Security Policies | 访问权限与安全策略
Access rights define what different users can do on a system. The principle of least privilege ensures users are given only the permissions they need to perform their tasks. User access levels (e.g., administrator, standard user) help enforce this separation.
访问权限定义不同用户在系统上可以做什么。最小权限原则确保用户仅获得执行任务所需的权限。用户访问级别（如管理员、标准用户）有助于实施这种分离。
Network policies are formal rules that govern acceptable use of an organisation’s IT resources. They cover password strength, software installation, email usage, and data handling. Regular audits help ensure compliance and identify weaknesses.
网络策略是管理组织 IT 资源可接受使用的正式规则。它们涵盖密码强度、软件安装、电子邮件使用和数据处理。定期审计有助于确保合规并识别弱点。
Questions may ask you to suggest a policy or explain why limiting access rights can reduce the impact of malware or insider threats.
问题可能会要求你提出一项策略，或解释为什么限制访问权限可以减少恶意软件或内部威胁的影响。
10. Penetration Testing and Patching | 渗透测试与补丁管理
Penetration testing (pen testing) is a controlled simulated attack on a system to identify security vulnerabilities before real attackers can exploit them. White-hat hackers perform these tests with the organisation’s permission and provide a report detailing weaknesses and recommended fixes.
渗透测试是一种受控的模拟攻击，旨在在实际攻击者利用安全漏洞之前找出它们。白帽黑客在组织许可下进行这些测试，并提供详细说明弱点和建议修复的报告。
Software patches are updates released by developers to fix security holes. Keeping operating systems, browsers, and applications up to date is one of the simplest and most effective defences. Patch management ensures timely deployment across all devices.
软件补丁是开发人员发布用于修复安全漏洞的更新。保持操作系统、浏览器和应用程序最新是最简单、最有效的防御之一。补丁管理确保所有设备及时部署更新。
In the exam, you should be able to explain why organisations conduct pen tests and why patch management is essential for maintaining cyber resilience.
在考试中，你应能解释为什么组织进行渗透测试，以及为什么补丁管理对于维持网络弹性至关重要。
11. Physical Security and Backup Strategies | 物理安全与备份策略
Physical security prevents unauthorised physical access to hardware. Measures include locked doors, biometric entry systems, security guards, and CCTV. Without physical security, even the strongest digital defences can be bypassed by directly accessing servers or stealing devices.
物理安全防止未经授权对硬件的物理访问。措施包括上锁的门、生物识别门禁系统、保安和闭路电视。没有物理安全，即使最强的数字防御也可能因直接接触服务器或窃取设备而被绕过。
Regular data backups are vital for recovery after ransomware, hardware failure, or human error. The 3-2-1 backup rule recommends three copies of data, on two different media, with one copy off-site. Backups should be tested regularly to ensure they can be restored successfully.
定期数据备份对于勒索软件、硬件故障或人为错误后的恢复至关重要。3-2-1 备份规则建议保留三份数据副本，存储在两种不同的介质上，其中一份异地存放。应定期测试备份以确保可以成功恢复。
Questions may combine physical security with network threats, asking you to suggest a comprehensive security plan that addresses both.
问题可能将物理安全与网络威胁结合，要求你提出同时解决两者的全面安全计划。
12. Exam-Style Tips and Common Pitfalls | 考试技巧与常见误区
When answering cybersecurity questions, always use precise technical vocabulary. Instead of saying ‘a virus that locks files’, write ‘ransomware encrypts files and demands a ransom’. Link threats to consequences: for example, ‘DoS attacks prevent customers from accessing the service, causing financial loss and reputational damage’.
回答网络安全问题时，务必使用精确的技术术语。不要说“一种锁定文件的病毒”，而应写“勒索软件加密文件并要求赎金”。将威胁与后果联系起来：例如，“DoS 攻击使客户无法访问服务，造成经济损失和声誉损害”。
Do not confuse authentication (verifying identity) with authorisation (determining allowed actions). Many students also mix up brute-force and DoS attacks; remember that brute-force targets credentials, while DoS targets availability. Always read the context carefully: if a question mentions ‘a flood of traffic’, it is DoS, not brute-force.
不要将身份验证（核实身份）与授权（确定允许的操作）混淆。许多学生也混淆了暴力攻击和 DoS 攻击；记住暴力攻击针对凭据，而 DoS 针对可用性。务必仔细阅读上下文：如果题目提到“流量洪流”，那就是 DoS，而不是暴力攻击。
Finally, when asked to evaluate security measures, give both advantages and disadvantages. For instance, biometrics are convenient and hard to steal, but they cannot be reset if compromised and may raise privacy concerns. This balanced approach earns higher marks.
最后，当被要求评估安全措施时，要给出优点和缺点。例如，生物识别方便且不易被盗，但如果泄露则无法重置，并可能引发隐私担忧。这种平衡的回答能获得更高分数。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
屏轩国际教育cambridge primary/secondary checkpoint, cat4, ukiset,ukcat,igcse,alevel,PAT,STEP,MAT, ibdp,ap,ssat,sat,sat2课程辅导，国外大学本科硕士研究生博士课程论文辅导