Network Security: Key Exam Topics Explained | 网络安全考点精讲

📚 Network Security: Key Exam Topics Explained | 网络安全考点精讲

Network security is a cornerstone of modern computer science, covering the principles, technologies, and practices used to protect data, devices, and communications from unauthorised access, attacks, or damage. In IB and CIE syllabuses, you need to understand both the threats that compromise systems and the countermeasures that defend them. This article breaks down the essential topics you’ll encounter in your exams, with clear English and Chinese explanations paired to reinforce your revision.

网络安全是现代计算机科学的基石，涵盖了用于保护数据、设备和通信免受未经授权访问、攻击或破坏的原理、技术和实践。在 IB 和 CIE 课程大纲中，你既需要了解危害系统的威胁，也需要掌握防御它们的对策。本文剖析了考试中会遇到的核心主题，以清晰的中英文对照解释来巩固复习效果。

---

1. Understanding Network Security | 理解网络安全

Network security aims to maintain the confidentiality, integrity, and availability of data and systems — often called the CIA triad. Confidentiality ensures that only authorised parties can access information; integrity guarantees that data is not altered in transit or storage; availability ensures that authorised users can access resources when needed.

网络安全旨在维护数据和系统的机密性、完整性和可用性（通常称为 CIA 三元组）。机密性确保只有授权方才能访问信息；完整性保证数据在传输或存储过程中未被篡改；可用性确保授权用户在需要时能够访问资源。

An effective security policy combines preventive, detective, and corrective controls. Preventive controls (e.g. firewalls, encryption) stop incidents before they happen. Detective controls (e.g. intrusion detection systems, log monitoring) identify breaches in progress. Corrective controls (e.g. backups, patch management) restore systems after an incident.

有效的安全策略结合了预防性、检测性和纠正性控制措施。预防性控制（如防火墙、加密）在事件发生前加以阻止。检测性控制（如入侵检测系统、日志监控）识别正在发生的违规行为。纠正性控制（如备份、补丁管理）在事件发生后恢复系统。

---

2. Common Threats: Malware, Phishing, DoS | 常见威胁：恶意软件、网络钓鱼、拒绝服务

Malware (malicious software) includes viruses, worms, trojans, ransomware, and spyware. A virus attaches to legitimate programs and spreads when executed; a worm replicates itself across networks without user intervention; a trojan disguises itself as useful software; ransomware encrypts files and demands payment; spyware secretly monitors user activity.

恶意软件包括病毒、蠕虫、木马、勒索软件和间谍软件。病毒附着在合法程序上，执行时传播；蠕虫无需用户干预即可在网络中自我复制；木马伪装成有用软件；勒索软件加密文件并要求赎金；间谍软件秘密监视用户活动。

Phishing is a social engineering technique where attackers send fraudulent emails or messages pretending to be trusted entities to trick recipients into revealing sensitive information such as passwords or credit card details. Spear phishing targets specific individuals or organisations with personalised content.

网络钓鱼是一种社会工程学技术，攻击者发送伪装成可信实体的欺诈性电子邮件或消息，诱骗收件人泄露密码或信用卡信息等敏感数据。鱼叉式网络钓鱼利用个性化内容针对特定个人或组织。

A Denial-of-Service (DoS) attack floods a server or network with excessive traffic, making it unavailable to legitimate users. A Distributed DoS (DDoS) uses multiple compromised devices (a botnet) to amplify the attack, making it harder to block.

拒绝服务攻击用过量流量淹没服务器或网络，使其对合法用户不可用。分布式拒绝服务攻击利用多个受感染的设备（僵尸网络）放大攻击效果，使其更难阻挡。

---

3. Social Engineering Attacks | 社会工程学攻击

Social engineering exploits human psychology rather than technical vulnerabilities. Common tactics include pretexting (creating a fabricated scenario to obtain information), baiting (offering something enticing to deliver malware), and tailgating (following an authorised person into a secure area).

社会工程学攻击利用人类心理而非技术漏洞。常见手法包括借口（编造情境获取信息）、诱饵（提供诱人事物以植入恶意软件）和尾随（跟随授权人员进入安全区域）。

Phishing, vishing (voice phishing), and smishing (SMS phishing) are all forms of social engineering. Attackers often create a sense of urgency or fear to pressure victims into acting without thinking. Education and awareness training is the most effective defence against social engineering.

网络钓鱼、语音钓鱼和短信钓鱼均属于社会工程学形式。攻击者经常制造紧迫感或恐惧感，迫使受害者不加思考就行动。教育和意识培训是防范社会工程学的最有效防御手段。

Shoulder surfing and dumpster diving are also low-tech social engineering methods. In an exam, you may be asked to identify the type of attack or suggest countermeasures such as security policies and physical access controls.

肩窥和垃圾搜寻也是低技术含量的社会工程学手段。考试中可能要求你识别攻击类型或提出对策，如安全策略和物理访问控制。

---

4. Data Encryption and Cryptography | 数据加密与密码学

Encryption transforms plaintext into ciphertext using an algorithm and a key, ensuring only authorised parties with the correct key can decrypt it. Cryptography provides confidentiality, authentication, integrity, and non-repudiation — essential building blocks of secure communication.

加密使用算法和密钥将明文转换为密文，确保只有持有正确密钥的授权方才能解密。密码学提供机密性、认证、完整性和不可否认性，是安全通信的基本构件。

There are two main types of encryption: symmetric (private-key) and asymmetric (public-key). In symmetric encryption, the same key is used for both encryption and decryption. It is fast and suitable for bulk data, but key distribution is a challenge. In asymmetric encryption, a key pair — public and private — is used; the public key encrypts, and the private key decrypts. This solves the key distribution problem but is computationally slower.

加密主要有两种类型：对称（私钥）加密和非对称（公钥）加密。对称加密中，加密和解密使用同一密钥。它速度快，适合批量数据，但密钥分发是个难题。非对称加密使用一对密钥（公钥和私钥）；公钥加密，私钥解密。这解决了密钥分发问题，但计算速度较慢。

---

5. Firewalls and Packet Filtering | 防火墙与数据包过滤

A firewall is a network security device that monitors incoming and outgoing traffic based on a set of security rules. It can be hardware-based, software-based, or a combination of both. Firewalls establish a barrier between trusted internal networks and untrusted external networks, such as the internet.

防火墙是一种根据一组安全规则监控进出流量的网络安全设备。它可以是基于硬件的、基于软件的，或两者结合。防火墙在受信任的内部网络与不可信的外部网络（如互联网）之间建立一道屏障。

Packet filtering inspects the header of each data packet, checking source and destination IP addresses, port numbers, and protocols. Rules determine whether a packet is allowed or denied. Stateful inspection goes further by tracking the state of active connections, ensuring that incoming packets are part of an established session.

数据包过滤检查每个数据包的报头，查看源和目标 IP 地址、端口号及协议。规则决定数据包是被允许还是拒绝。状态检测更进一步，跟踪活动连接的状态，确保传入数据包属于已建立的会话。

Application-layer firewalls (proxy firewalls) can inspect application data, filtering content based on deep packet inspection. In exams, you may need to explain how firewalls mitigate threats such as unauthorised access and DoS attacks.

应用层防火墙（代理防火墙）可以检查应用数据，基于深度包检测过滤内容。考试中可能需要解释防火墙如何缓解未授权访问和 DoS 攻击等威胁。

---

6. Authentication Methods and Passwords | 认证方法与密码

Authentication verifies the identity of a user, device, or process. It can be based on something you know (passwords, PINs), something you have (smart cards, security tokens), or something you are (biometrics: fingerprints, facial recognition, iris scans).

认证用于验证用户、设备或进程的身份。它可以基于你知道的东西（密码、PIN 码）、你拥有的东西（智能卡、安全令牌）或你本身的东西（生物特征：指纹、面容识别、虹膜扫描）。

Multi-factor authentication (MFA) combines two or more independent categories, significantly improving security. For example, withdrawing cash from an ATM requires something you have (the bank card) and something you know (the PIN).

多因素认证结合了两个或多个独立类别，大幅提升安全性。例如，从 ATM 取款需要你拥有的东西（银行卡）和你知道的东西（PIN 码）。

Strong password policies require length, complexity, and regular changes. However, passwords are vulnerable to brute-force attacks, dictionary attacks, and phishing. Hashing passwords (storing only the hash) and using salts can mitigate risks if databases are breached.

强密码策略要求长度、复杂性和定期更换。然而，密码容易受到暴力破解、字典攻击和网络钓鱼的威胁。对密码进行哈希处理（仅存储哈希值）并使用盐值，可以在数据库被泄露时降低风险。

---

7. Symmetric vs Asymmetric Encryption | 对称加密与非对称加密

Let’s compare symmetric and asymmetric encryption more systematically. Symmetric encryption uses a single shared key. Common algorithms include AES (Advanced Encryption Standard) and DES (Data Encryption Standard). It is efficient for encrypting large volumes of data but requires secure key exchange beforehand.

让我们更系统地比较对称和非对称加密。对称加密使用单个共享密钥。常见算法包括 AES（高级加密标准）和 DES（数据加密标准）。它对于加密大量数据非常高效，但需要事先安全交换密钥。

Asymmetric encryption uses mathematically related key pairs. Examples include RSA (Rivest-Shamir-Adleman) and ECC (Elliptic Curve Cryptography). It is widely used for secure key exchange (e.g., in TLS handshake) and digital signatures. The private key must remain secret, while the public key can be freely distributed.

非对称加密使用数学上相关的密钥对。例子包括 RSA 和 ECC（椭圆曲线密码学）。它广泛用于安全密钥交换（如 TLS 握手中）和数字签名。私钥必须保密，公钥可以自由分发。

Aspect | 方面	Symmetric | 对称	Asymmetric | 非对称
Keys | 密钥	Single shared key | 单一共享密钥	Public + private key pair | 公钥+私钥对
Speed | 速度	Fast | 快	Slower | 较慢
Use case | 用例	Bulk data encryption | 批量数据加密	Key exchange, digital signatures | 密钥交换、数字签名
Key distribution problem | 密钥分发问题	Yes | 存在	Solved | 已解决

---

8. Digital Signatures and Certificates | 数字签名与证书

A digital signature is created by encrypting a message digest (hash) with the sender’s private key. The recipient decrypts it with the sender’s public key and compares it with a newly computed hash of the received message. If they match, the message is authentic, has not been tampered with, and the sender cannot deny having sent it (non-repudiation).

数字签名通过用发送者的私钥加密消息摘要（哈希）生成。接收者用发送者的公钥解密，并将其与收到的消息新计算的哈希进行比较。若匹配，则消息真实、未被篡改，且发送者无法否认发送行为（不可否认性）。

Digital certificates bind a public key to an entity’s identity, issued by a trusted Certificate Authority (CA). A certificate contains the owner’s name, public key, expiration date, and the CA’s digital signature. Web servers use SSL/TLS certificates to enable HTTPS connections.

数字证书将公钥与实体身份绑定，由受信任的证书颁发机构签发。证书包含所有者名称、公钥、有效期和 CA 的数字签名。Web 服务器使用 SSL/TLS 证书来启用 HTTPS 连接。

In an exam, you might be asked to describe how digital signatures provide authentication and integrity, or to draw a diagram showing the signing and verification process. Remember that the hash function (e.g., SHA‑256) is a one-way function—it is computationally infeasible to reverse.

考试中可能要求描述数字签名如何提供认证和完整性，或绘制显示签名和验证过程的图表。请记住，哈希函数（如 SHA‑256）是单向函数，在计算上不可逆。

---

9. Security Protocols: SSL/TLS, HTTPS | 安全协议：SSL/TLS、HTTPS

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are protocols that provide encryption, authentication, and data integrity for network communications. When a client connects to a server over HTTPS, a TLS handshake occurs. The client and server agree on cipher suites, authenticate (optionally mutually), and establish session keys using asymmetric encryption, then switch to faster symmetric encryption for the data transfer.

SSL（安全套接层）及其继任者 TLS（传输层安全）是为网络通信提供加密、认证和数据完整性的协议。当客户端通过 HTTPS 连接到服务器时，会进行 TLS 握手。客户端和服务器商定密码套件，进行认证（可选双向），并使用非对称加密建立会话密钥，然后切换到更快的对称加密进行数据传输。

HTTPS (HyperText Transfer Protocol Secure) is HTTP over TLS. It ensures that data between a browser and a web server is encrypted, preventing eavesdropping and man-in-the-middle (MITM) attacks. The padlock icon in the address bar indicates a valid certificate and an encrypted session.

HTTPS（超文本传输协议安全）是运行在 TLS 之上的 HTTP。它确保浏览器与 Web 服务器之间的数据被加密，防止窃听和中间人攻击。地址栏中的挂锁图标表示拥有有效证书和加密会话。

Other important protocols include IPsec (for VPNs), SSH (Secure Shell for remote login), and SFTP (Secure File Transfer Protocol). You should know the difference between transport-layer security and application-layer security.

其他重要协议包括 IPsec（用于 VPN）、SSH（用于远程登录的安全外壳）和 SFTP（安全文件传输协议）。你应了解传输层安全与应用层安全的区别。

---

10. Mitigating Network Threats: Best Practices | 缓解网络威胁：最佳实践

A layered security strategy (defence in depth) uses multiple controls to protect against threats. These include anti-malware software, regular software updates and patches, network segmentation, intrusion detection/prevention systems (IDS/IPS), and access control lists (ACLs).

分层安全策略（纵深防御）使用多种控制措施来防范威胁，包括反恶意软件、定期软件更新和补丁、网络分段、入侵检测/防御系统（IDS/IPS）以及访问控制列表（ACL）。

User education is one of the most cost-effective measures. Teaching users to recognise phishing emails, avoid suspicious downloads, and follow strong password practices can prevent many attacks. Regular backups (preferably offline or off-site) protect against ransomware and data loss.

用户教育是最具成本效益的措施之一。教导用户识别钓鱼邮件、避免可疑下载并遵循强密码实践，可以防范许多攻击。定期备份（最好是离线或异地）可防止勒索软件和数据丢失。

Penetration testing and vulnerability scanning help organisations identify weaknesses before attackers do. Ethical hacking, when performed under agreed rules, simulates real-world attacks to test defences. Logs and monitoring enable rapid detection and response to incidents.

渗透测试和漏洞扫描帮助组织在攻击者之前发现弱点。道德黑客在约定规则下模拟真实攻击以测试防御能力。日志与监控使得能够快速检测和响应事件。

---

11. Data Integrity and Hashing | 数据完整性与哈希

Data integrity ensures that information remains accurate and consistent during storage, processing, and transmission. Hashing is a technique that maps data of arbitrary size to a fixed-size value (hash or message digest). Even a tiny change in the input produces a completely different hash—this property is called the avalanche effect.

数据完整性确保信息在存储、处理和传输期间保持准确和一致。哈希是一种将任意大小的数据映射为固定大小值（哈希或消息摘要）的技术。输入中哪怕极小的变化也会产生完全不同的哈希——这一特性称为雪崩效应。

Common hash functions include MD5 (now considered broken), SHA‑1 (deprecated), and the SHA‑2 family (e.g., SHA‑256). Hash functions are used to verify file integrity (checksums), store passwords securely, and create digital signatures. They must be collision-resistant, meaning it is infeasible to find two different inputs that produce the same hash.

常见哈希函数包括 MD5（现已被认为不安全）、SHA‑1（已弃用）和 SHA‑2 系列（如 SHA‑256）。哈希函数用于验证文件完整性（校验和）、安全存储密码和创建数字签名。它们必须具有抗碰撞性，即找到两个不同输入产生相同哈希在计算上不可行。

In the context of network security, hashing alone does not provide confidentiality—it provides integrity verification. To protect data, combine encryption with hashing (e.g., Encrypt-then-MAC) as seen in authenticated encryption models.

在网络安全语境中，单独的哈希不提供机密性——它提供完整性验证。为了保护数据，可将加密与哈希相结合（如先加密后 MAC），这在认证加密模式中可以看到。

---

12. Ethical and Legal Considerations | 伦理与法律考虑

Computer security professionals must operate within legal and ethical boundaries. Laws such as the Computer Misuse Act (UK), GDPR (Europe), or equivalent data protection regulations in other regions criminalise unauthorised access, data breaches, and malware distribution. Ethical hacking requires explicit permission and a defined scope.

计算机安全专业人员必须在法律和伦理边界内运作。诸如《计算机滥用法案》（英国）、《通用数据保护条例》（欧洲）或其他地区等效的数据保护法规将未经授权的访问、数据泄露和恶意软件传播定为犯罪。道德黑客需要明确许可和界定范围。

Privacy concerns arise when security measures involve monitoring user activity. Organisations must balance security with individual rights, using policies like acceptable use policies (AUPs) and transparent data handling. Whistleblowing protections and responsible disclosure practices are also part of the ethical landscape.

当安全措施涉及监控用户活动时，就会产生隐私问题。组织必须在安全与个人权利之间取得平衡，采用可接受使用政策和透明的数据处理等方式。举报人保护和负责任的披露实践也是伦理环境的一部分。

In IB and CIE examinations, you could be asked to discuss the social and ethical implications of security technologies, such as bulk surveillance, encryption backdoors, or the tension between national security and individual privacy.

在 IB 和 CIE 考试中，你可能会被要求讨论安全技术的社会和伦理影响，例如大规模监控、加密后门，或国家安全与个人隐私之间的张力。

Published by TutorHao | Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）