Network Security | 网络安全考点精讲

📚 Network Security | 网络安全考点精讲

Network security is a cornerstone of modern computing, vital in safeguarding data, systems, and communications from unauthorised access, misuse, or attack. In the Edexcel A-Level Computer Science syllabus, you are expected to understand the principal threats facing networked systems, the defensive mechanisms employed to counter them, and the legal and ethical frameworks that govern cybersecurity practice. This article consolidates these key concepts, providing clear explanations alongside real-world relevance to help you master the examination content.

网络安全是现代计算的基石，对于保护数据、系统和通信免遭未授权访问、滥用或攻击至关重要。在Edexcel A-Level计算机科学大纲中，你需要理解网络系统面临的主要威胁、应对这些威胁的防御机制，以及规范网络安全实践的法律与道德框架。本文汇总了这些关键概念，提供清晰的解释并结合实际意义，帮助你掌握考试内容。

1. What is Network Security? | 什么是网络安全？

Network security refers to the policies, practices, and technologies designed to protect the integrity, confidentiality, and availability of computer networks and data. It encompasses both hardware and software measures to defend against a wide range of threats, from unauthorised access to data interception and disruption of services. The core principles of information security—often called the CIA triad—are Confidentiality (keeping data secret), Integrity (preventing unauthorised modification), and Availability (ensuring systems and data are accessible when needed).

网络安全是指旨在保护计算机网络和数据的完整性、机密性和可用性的策略、实践和技术。它包括硬件和软件措施，以防御从非授权访问到数据拦截和服务中断等广泛威胁。信息安全的核心原则（常称 CIA三元组）是机密性（保持数据秘密）、完整性（防止未授权修改）和可用性（确保系统和数据在需要时可访问）。

2. Common Network Threats | 常见网络威胁

A threat is any potential cause of an unwanted incident that may harm a system or organisation. In the context of networks, threats can be intentional (e.g. hacking, malware) or accidental (e.g. user error, hardware failure). Understanding the threat landscape is essential for effective defence. Key categories include malware, social engineering, denial‑of‑service attacks, man‑in‑the‑middle attacks, and insider threats. The risk associated with each threat depends on the vulnerability of the system and the capability of the attacker.

威胁是指可能对系统或组织造成损害的任何潜在事件诱因。在网络环境中，威胁可能是有意的（例如，黑客攻击、恶意软件）或意外的（例如，用户错误、硬件故障）。理解威胁态势对于有效防御至关重要。主要类别包括恶意软件、社会工程学、拒绝服务攻击、中间人攻击和内部威胁。每个威胁的风险取决于系统的脆弱性和攻击者的能力。

3. Malware: Viruses, Worms, and Trojans | 恶意软件：病毒、蠕虫与木马

Malware (malicious software) is any program designed to infiltrate, damage, or disrupt a computer system. A virus attaches itself to a legitimate program or file and replicates when that host is executed, spreading to other files. A worm is a standalone program that propagates across networks without needing a host, often exploiting vulnerabilities. A Trojan horse disguises itself as useful software but carries a hidden malicious payload, such as a backdoor for remote access. Modern malware can include ransomware, spyware, and rootkits, which operate covertly to maintain privileged access.

恶意软件是指旨在渗透、破坏或扰乱计算机系统的任何程序。病毒将其自身附着在合法程序或文件上，当宿主执行时自我复制，传播到其他文件。蠕虫是一种独立程序，无需宿主即可在网络上传播，通常利用漏洞。木马将自己伪装成有用的软件，但携带隐藏的恶意负载，例如用于远程访问的后门。现代恶意软件可能包括勒索软件、间谍软件和rootkit，它们秘密运行以维持特权访问。

Virus: requires human action to spread; often corrupts files.
病毒：需要人为操作才能传播；常损坏文件。
Worm: self-replicating; uses network services to infect other machines automatically.
蠕虫：自我复制；自动利用网络服务感染其他机器。
Trojan: relies on social engineering to be executed; does not self-replicate.
木马：依靠社会工程学被执行；不自我复制。

4. Social Engineering and Phishing | 社会工程学与钓鱼攻击

Social engineering exploits human psychology rather than technical vulnerabilities to gain confidential information or access. Attackers manipulate individuals into breaking normal security procedures. Phishing is the most common form, using deceptive emails or messages that appear to come from trusted sources to trick recipients into revealing passwords, credit card numbers, or other sensitive data. Spear phishing targets specific individuals, while whaling goes after high-profile executives. Pretexting, baiting, and tailgating are other social engineering techniques that rely on creating a false scenario or exploiting trust.

社会工程学利用人的心理而非技术漏洞来获取机密信息或访问权限。攻击者操纵个人，使其绕过正常的安全程序。钓鱼攻击是最常见的形式，使用看似来自可信来源的欺骗性电子邮件或信息，诱骗收件人泄露密码、信用卡号或其他敏感数据。鱼叉式钓鱼针对特定个人，而捕鲸攻击则瞄准高管。假托、诱饵和尾随是其他社会工程学手段，依赖于制造虚假情景或利用信任。

5. Denial-of-Service (DoS) & DDoS Attacks | (分布式)拒绝服务攻击

A Denial-of-Service attack aims to make a machine or network resource unavailable to its intended users by overwhelming it with traffic or exploiting protocol weaknesses. In a Distributed Denial‑of‑Service (DDoS) attack, multiple compromised systems—often a botnet—are used to flood the target with requests simultaneously, making mitigation more difficult. The volumetric attack exhausts bandwidth, while application-layer attacks target specific services, such as HTTP floods. The impact includes lost revenue, degraded reputation, and potential data loss if used as a smokescreen for other intrusions.

拒绝服务攻击的目标是通过大量流量淹没目标或利用协议弱点，使机器或网络资源对其预期用户不可用。在分布式拒绝服务（DDoS）攻击中，多个受感染系统（通常是僵尸网络）同时向目标发送大量请求，使缓解更加困难。大流量攻击耗尽带宽，而应用层攻击则针对特定服务，如HTTP洪水。其影响包括收入损失、声誉下降，以及如果用作其他入侵的掩护，可能导致数据丢失。

6. Man-in-the-Middle (MitM) and Session Hijacking | 中间人攻击与会话劫持

A Man-in-the-Middle attack occurs when an adversary secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. On unsecured Wi‑Fi, an attacker can intercept data using packet sniffing tools. An advanced form is an SSL stripping attack that downgrades a secure HTTPS connection to HTTP. Session hijacking involves stealing or predicting a valid session token to impersonate a user after they have authenticated, allowing unauthorised access to web applications. Countermeasures include strong encryption (TLS) and the use of secure session management with random, non‑predictable tokens.

中间人攻击发生在对手秘密中继甚至修改双方通信时，而双方以为彼此直接通信。在不安全的Wi‑Fi上，攻击者可以使用数据包嗅探工具拦截数据。一种高级形式是SSL剥离攻击，将安全的HTTPS连接降级为HTTP。会话劫持涉及窃取或预测有效的会话令牌，在用户认证后冒充其身份，从而未授权访问Web应用程序。对策包括强加密（TLS）和使用安全的会话管理，配备随机、不可预测的令牌。

7. Encryption: Symmetric vs Asymmetric | 加密：对称加密与非对称加密

Encryption is the process of converting plaintext into ciphertext using an algorithm and a key, ensuring confidentiality. Symmetric encryption uses the same key for both encryption and decryption; it is fast and suitable for bulk data transfer. Common symmetric algorithms include AES and DES. Asymmetric encryption (public‑key cryptography) uses a key pair—a public key for encryption and a private key for decryption. RSA is a widely used asymmetric algorithm. Asymmetric encryption solves the key distribution problem but is computationally slower, so hybrid systems (e.g. TLS handshake) use asymmetric encryption to securely exchange a symmetric session key.

加密是使用算法和密钥将明文转换为密文的过程，确保机密性。对称加密使用同一密钥进行加密和解密；速度快，适用于批量数据传输。常见的对称算法包括AES和DES。非对称加密（公钥密码学）使用密钥对——公钥用于加密，私钥用于解密。RSA是广泛使用的非对称算法。非对称加密解决了密钥分发问题，但计算速度较慢，因此混合系统（例如TLS握手）使用非对称加密来安全交换对称会话密钥。

Feature / 特性	Symmetric / 对称	Asymmetric / 非对称
Key relationship / 密钥关系	Same key for encrypt & decrypt	Public + private key pair
Speed / 速度	Fast	Slow (∼1000× slower)
Key distribution / 密钥分发	Problematic: needs secure channel	Public key can be shared openly
Example / 示例	AES, DES, ChaCha20	RSA, ECC, Diffie–Hellman (key exchange)

8. Firewalls and Packet Filtering | 防火墙与包过滤

A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules. Packet‑filtering firewalls inspect headers of individual packets and permit or deny them according to source/destination IP addresses, ports, and protocols. Stateful firewalls track the state of active connections and make decisions on the context. Application‑layer firewalls (proxy firewalls) examine the payload of packets at the application level, blocking malicious content such as SQL injection or XSS. Network Address Translation (NAT) is often combined with a firewall to hide internal IP addresses and add a layer of separation.

防火墙是一种网络安全系统，根据预定的安全规则监控和控制进出流量。包过滤防火墙检查每个数据包的头部，根据源/目标IP地址、端口和协议允许或拒绝。状态防火墙跟踪活跃连接的状态，基于上下文做出决策。应用层防火墙（代理防火墙）在应用层面检查数据包负载，阻止恶意内容，如SQL注入或XSS。网络地址转换（NAT）常与防火墙结合使用，隐藏内部IP地址并增加隔离层。

9. Authentication, Digital Signatures & Certificates | 认证、数字签名与证书

Authentication verifies the identity of a user or device. Multi‑factor authentication (MFA) combines something you know (password), something you have (token), and something you are (biometric). Digital signatures provide integrity and non‑repudiation by signing a document with the sender’s private key; the recipient uses the sender’s public key to verify the signature. Digital certificates bind a public key to an entity, issued by a trusted Certificate Authority (CA). They contain the owner’s public key, identity information, and the CA’s digital signature. The X.509 standard is commonly used for TLS certificates.

认证用于验证用户或设备身份。多因素认证（MFA）结合你知道的东西（密码）、你拥有的东西（令牌）和你是的东西（生物特征）。数字签名通过用发送者的私钥签署文档，提供完整性和不可否认性；接收者使用发送者的公钥验证签名。数字证书将公钥与实体绑定，由受信任的证书颁发机构（CA）签发。证书包含所有者的公钥、身份信息和CA的数字签名。X.509标准通常用于TLS证书。

10. Security Protocols: SSL/TLS and HTTPS | 安全协议：SSL/TLS与HTTPS

Transport Layer Security (TLS), the successor to Secure Sockets Layer (SSL), is a cryptographic protocol that provides secure communication over a computer network. It uses a handshake to establish an encrypted session: the client and server agree on cipher suites, authenticate (optionally using digital certificates), and generate a shared session key via asymmetric cryptography. Once the session key is established, symmetric encryption ensures fast data transfer. HTTPS (HTTP over TLS) secures web traffic, indicated by a padlock icon in the browser. TLS also underpins secure email (STARTTLS), VPN tunnels, and secure FTP.

传输层安全（TLS）是安全套接字层（SSL）的后继者，是一种提供计算机网络通信安全的加密协议。它使用握手过程建立加密会话：客户端和服务器协商密码套件、认证（可选使用数字证书），并通过非对称密码生成共享的会话密钥。会话密钥建立后，对称加密确保快速数据传输。HTTPS（基于TLS的HTTP）保护Web流量，浏览器中显示锁形图标。TLS也是安全电子邮件（STARTTLS）、VPN隧道和安全FTP的基础。

TLS Handshake (simplified): ClientHello → ServerHello + Certificate → Key Exchange → Finished

TLS握手（简化）：ClientHello → ServerHello + Certificate → Key Exchange → Finished

11. Network Policies, Auditing, and Penetration Testing | 网络策略、审计与渗透测试

Organisations use formal security policies to define acceptable use, access rights, password complexity, and incident response procedures. Audit trails (logging) record user activity and system events, providing accountability and forensic evidence for security breaches. Penetration testing (pen testing) simulates real‑world attacks to identify vulnerabilities before malicious actors can exploit them. It may involve white‑box testing (full knowledge of the system) or black‑box testing (no prior knowledge). Ethical hackers follow a strict code of conduct and report findings responsibly. Regular patching of software and firmware closes known security holes.

组织使用正式的安全策略来界定可接受的使用、访问权限、密码复杂度和事件响应流程。审计跟踪（日志记录）记录用户活动和系统事件，为安全漏洞提供问责和取证证据。渗透测试模拟真实攻击，在恶意行为者利用之前识别漏洞。它可能涉及白盒测试（对系统完全了解）或黑盒测试（事先不了解）。道德黑客遵守严格的行为准则，并负责任地报告发现结果。定期给软件和固件打补丁可以关闭已知的安全漏洞。

12. Legal and Ethical Considerations | 法律与道德考量

The Computer Misuse Act 1990 (UK) criminalises unauthorised access to computer material, unauthorised access with intent to commit or facilitate further offences, and unauthorised acts with intent to impair operation of a computer. The Data Protection Act 2018 (incorporating GDPR) governs the processing of personal data, requiring lawful, fair, and transparent handling. Organisations must enforce data protection by design, report breaches within 72 hours, and respect individuals’ rights. Ethical conduct in cybersecurity includes responsible vulnerability disclosure, respect for privacy, and the exercise of skill within legal boundaries.

《1990年计算机滥用法案》（英国）将未经授权访问计算机资料、未经授权访问意图实施或协助进一步犯罪，以及未经授权行为意图损害计算机运行的行为定为犯罪。《2018年数据保护法》（纳入GDPR）规范个人数据的处理，要求合法、公平、透明地处理。组织必须在设计上贯彻数据保护原则，在72小时内报告泄露事件，并尊重个人权利。网络安全中的道德操守包括负责任的漏洞披露、尊重隐私以及在法律范围内运用技能。

Published by TutorHao | Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）

Network Security | 网络安全 考点精讲