5.3 · Cyber security
5.3 · 网络安全
Cyber security
网络安全
Nine cyber security threats, the process each one uses and the aim behind it, and ten solutions that help keep data safe, with the threat each one defends against.
九种网络安全威胁,每一种所使用的过程及其背后的目的;以及十种有助于保护数据安全的防护措施,以及每一种针对的威胁。
Explainer · 5.3.1
讲解 · 5.3.1
Two things earn the marks: the process and the aim
拿分的是两样东西:过程和目的
A cyber security threat is a way of gaining access to data, or of stopping others from using a system, without permission. For each threat the syllabus names, a question can ask two separate things.
网络安全威胁是指在未经许可的情况下,获取数据、或阻止他人使用某个系统的手段。对于考纲点名的每一种威胁,题目可以问两件不同的事。
| The question asks for | 题目要求的是 | You answer with | 你要回答的是 |
|---|---|---|---|
| The process | 过程 | the steps the attacker actually carries out, in order, using the correct technical terms | 攻击者实际执行的步骤,按顺序、用正确的技术术语说出来 |
| The aim | 目的 | what the attacker wants out of it: steal data, get money, deny access, take control | 攻击者想从中得到什么:窃取数据、获取钱财、阻止访问、夺取控制权 |
Markers report that answers stay too vague ("the hacker gets in and steals stuff") and often just repeat the question. Name the method, put the steps in order, and use the given context. If a diagram is asked for, keep it simple and clearly annotated; elaborate artwork earns few marks.
考官报告指出,考生的作答太笼统("黑客进去偷东西"),而且常常只是重复题目。要说出方法名称、把步骤排好顺序、并结合题目给定的情境。如果题目要求画图,要简单、标注清楚;画得再精美也拿不到几分。
Explainer · 5.3.1
讲解 · 5.3.1
The nine threats
九种威胁
These are the threats the syllabus names. Malware is one entry, split into six types in the next section.
这些是考纲点名的威胁。恶意软件算作其中一项,下一节再拆成六种类型。
| Threat | 威胁 | Process (the steps) | 过程(如何实施) | Aim | 目的 |
|---|---|---|---|---|---|
| Brute-force attack | 暴力破解攻击 | software tries one combination of characters after another, often working through a list of common words first, until the password matches | 软件一个接一个地尝试字符组合,通常先跑一遍常见词表,直到某个组合与密码相符 | to work out a password and gain access to the account | 推算出密码,从而进入该账户 |
| Data interception | 数据拦截 | a third party taps a wired or wireless link and copies the data packets as they travel, for example with packet-sniffing software or over open public Wi-Fi | 第三方接入有线或无线链路,在数据包传输途中把它们复制下来,例如用抓包软件、或在开放的公共 Wi-Fi 上 | to read confidential data such as passwords or bank details | 读取机密数据,例如密码或银行信息 |
| DDoS attack | DDoS 攻击 | the attacker infects many computers so they become bots; all the bots send requests to one server at the same time, so it is flooded and cannot answer real users | 攻击者感染大量计算机,使它们变成"肉鸡";这些肉鸡同时向一台服务器发送请求,服务器被淹没,无法响应真实用户 | to stop legitimate users reaching a website or online service | 阻止正常用户访问某个网站或在线服务 |
| Hacking | 黑客入侵 | getting into a computer system that you are not allowed to use, for example past weak passwords or through a gap in security | 未经许可进入某个计算机系统,例如绕过弱密码、或利用安全漏洞 | to view, change, delete or pass on the data that is found | 查看、更改、删除或转发所找到的数据 |
| Malware | 恶意软件 | harmful software gets onto the device (an attachment, an infected download, another piece of malware) and runs | 有害软件进入设备(附件、被感染的下载文件、另一个恶意软件)并运行 | to damage data, steal data or take control (depends on the type, see 5.3.1 malware) | 破坏数据、窃取数据或夺取控制权(取决于类型,见 5.3.1 恶意软件) |
| Pharming | 域欺骗(pharming) | malicious code on the user's device, or on a DNS server, changes the IP address a domain name points to, so the browser opens a fake site even when the correct address is typed; the user does nothing | 用户设备上、或某台 DNS 服务器上的恶意代码,篡改某个域名所对应的 IP 地址,于是即使输入的是正确地址,浏览器也会打开假网站;用户什么都不用做 | to lead the user onto a counterfeit site and collect the data they enter | 把用户引到假网站,收集他们输入的数据 |
| Phishing | 网络钓鱼(phishing) | the attacker sends a message that looks genuine, with a link or attachment; the user has to click it, which opens a fake website or asks them to reply with personal data | 攻击者发送一条看似真实的消息,带有链接或附件;用户必须去点击,点击后会打开一个假网站、或要求用户回复个人数据 | to trick the user into handing over personal or financial data | 诱骗用户交出个人或财务数据 |
| Social engineering | 社会工程 | the attacker manipulates a person (a phone call, a message, a memory stick left lying around) into breaking normal security, by playing on an emotion such as fear, curiosity or trust | 攻击者操纵某个人(打电话、发消息、故意丢一个 U 盘),利用恐惧、好奇或信任等情绪,让对方破坏正常的安全规程 | to get the person to reveal data, run malware, or grant access themselves | 让当事人自己泄露数据、运行恶意软件、或授予访问权限 |
Phishing, pharming and social engineering are not malware. Malware is software that is installed and runs on the device. Phishing and social engineering rely on tricking a person; pharming redirects the connection.
网络钓鱼、域欺骗和社会工程都不是恶意软件。恶意软件是安装并运行在设备上的软件。网络钓鱼和社会工程靠的是欺骗人;域欺骗则是改变连接的去向。
Try it yourself
动手试试
Explore each threat
逐一了解每种威胁
Click a threat to see its process and its aim side by side.
点击一种威胁,并排查看它的过程和目的。
Explainer · 5.3.1
讲解 · 5.3.1
The six types of malware
六种恶意软件
"Malware" is the umbrella term. The syllabus names six types, and a question often asks you to name a type and describe what it does.
"恶意软件"是一个总称。考纲点名了六种类型,题目常常要求你说出一种类型并描述它的行为。
| Type | 类型 | What it does | 它的行为 |
|---|---|---|---|
| Virus | 病毒 | code that copies itself into other files to delete or corrupt data or stop the computer working; it needs the user to run an infected program before it can act | 把自己复制到其他文件里的代码,用来删除或损坏数据、或让计算机无法工作;它需要用户先运行一个被感染的程序才能起作用 |
| Worm | 蠕虫 | stands alone and copies itself across a network on its own, without the user running anything, using weaknesses in network security to spread | 可独立存在,自行在网络上复制传播,无需用户运行任何东西,利用网络安全弱点扩散 |
| Trojan horse | 特洛伊木马 | disguised as a useful program; when the user runs it, it does harm or opens a way in for other malware such as spyware or ransomware | 伪装成有用的程序;用户运行后,它会造成破坏、或为间谍软件、勒索软件等其他恶意软件打开入口 |
| Spyware | 间谍软件 | runs hidden and watches what the user does, for example recording key presses, then sends the data (passwords, card numbers) back to the attacker | 隐蔽运行,监视用户的操作,例如记录按键,然后把数据(密码、卡号)发回给攻击者 |
| Adware | 广告软件 | floods the user with unwanted adverts, for example pop-ups, or redirects the browser; it can also point to weaknesses in the device's security | 用不需要的广告(例如弹窗)轰炸用户,或重定向浏览器;它也可能暴露设备安全上的弱点 |
| Ransomware | 勒索软件 | encrypts the data on the device so the user cannot open it, then demands a payment (a ransom) for the decryption key | 加密设备上的数据,使用户无法打开,然后索要一笔钱(赎金)以换取解密密钥 |
The dividing line the markers look for: a virus needs the user to run something; a worm spreads by itself. And anti-virus / anti-malware is a solution, not a type of malware.
考官看重的分界线:病毒需要用户去运行某个东西;蠕虫自己传播。另外,杀毒软件 / 反恶意软件是一种防护措施,不是一种恶意软件。
Try it yourself
动手试试
Does it self-replicate?
它会自我复制吗?
Tap each type to tag it as one that copies itself or one that does not, then check.
点击每种类型,把它标记为会自我复制还是不会,然后检查。
Explainer · 5.3.1
讲解 · 5.3.1
Phishing, pharming and social engineering
网络钓鱼、域欺骗与社会工程
These three get mixed up in exams more than any other part of the topic. The clearest test is: does the user have to do something, and is a person being manipulated or is the connection being changed?
在考试中,这三个被混淆的程度超过本主题的任何其他部分。最清楚的判别方法是:用户是否必须做点什么,以及被操纵的是一个人、还是被改变的是连接?
| Phishing | 网络钓鱼 | Pharming | 域欺骗 | Social engineering | 社会工程 | ||
|---|---|---|---|---|---|---|---|
| How it starts | 如何开始 | a fake but genuine-looking message with a link or attachment | 一条虚假但看似真实、带有链接或附件的消息 | malicious code on the device or a DNS server | 设备或 DNS 服务器上的恶意代码 | direct contact with a person (call, message, a planted memory stick) | 直接与人接触(电话、消息、事先放好的 U 盘) |
| Does the user act? | 用户需要动作吗? | yes, they must click the link | 需要,必须点击链接 | no, redirection happens even with the correct address typed | 不需要,即使输入正确地址也会被重定向 | yes, they are talked into doing it | 需要,他们是被说服去做的 |
| What is exploited | 被利用的是什么 | the user trusting the message | 用户对该消息的信任 | the way domain names are turned into IP addresses | 域名转换成 IP 地址的机制 | a human emotion: fear, curiosity or trust | 一种人类情绪:恐惧、好奇或信任 |
Markers note answers that mix phishing and pharming, for example saying pharming works by the user clicking an email link (that is phishing), or that phishing installs software on the computer (it does not).
考官指出,有些作答把网络钓鱼和域欺骗混在一起,例如说域欺骗是靠用户点击邮件链接实现的(那是网络钓鱼),或者说网络钓鱼会在计算机上安装软件(并不会)。
Try it yourself
动手试试
Phishing or pharming?
网络钓鱼还是域欺骗?
Tap each statement to tag it as phishing or pharming, then check.
点击每条陈述,把它标记为网络钓鱼还是域欺骗,然后检查。
Explainer · 5.3.2
讲解 · 5.3.2
The ten solutions
十种防护措施
Each solution has a job. In an exam, name the solution, say what it does, and match it to the threat in the question's context.
每一种防护措施都有它的职责。在考试中,要说出措施名称、说明它的作用,并把它与题目情境中的威胁对应起来。
| Solution | 措施 | What it does | 作用 | Mainly helps against | 主要针对 |
|---|---|---|---|---|---|
| Access levels | 访问级别 | give each user only the rights their role needs (read, write, delete), so a person can only see or change certain data | 只给每个用户其角色所需的权限(读、写、删),这样每个人只能查看或更改特定数据 | misuse of data by people who already have some access | 已有部分权限的人滥用数据 |
| Anti-malware (anti-virus and anti-spyware) | 反恶意软件(杀毒和反间谍) | scans files for known malware and for suspicious behaviour, then quarantines or removes what it finds; runs in the background and updates itself | 扫描文件,查找已知恶意软件和可疑行为,然后隔离或清除所发现的东西;在后台运行并自我更新 | viruses, worms, Trojan horses, spyware | 病毒、蠕虫、特洛伊木马、间谍软件 |
| Authentication | 身份验证 | the user proves who they are: a username and password (something they know), biometrics such as a fingerprint (something they are), or two-step verification, which also needs a one-time code sent to a registered device (something they have) | 用户证明自己的身份:用户名和密码(他们知道的东西)、指纹等生物识别(他们本身的特征)、或两步验证 (还需要一个发送到已登记设备上的一次性验证码,即他们拥有的东西) | brute-force attacks, hacking, stolen passwords | 暴力破解、黑客入侵、密码被盗 |
| Automating software updates | 自动进行软件更新 | the device downloads and installs security patches on its own, so known weaknesses are closed without waiting for the user | 设备自行下载并安装安全补丁,于是已知弱点会被修补,不用等用户动手 | malware and hacking that exploit known weaknesses | 利用已知弱点的恶意软件和黑客入侵 |
| Checking a message’s spelling and its tone | 检查通信内容的拼写和语气 | a genuine organisation does not send messages with spelling mistakes or language that rushes or pressures the reader; these are signs of a fake | 正规机构不会发送带有拼写错误、或催促、施压式语气的消息;这些都是伪造的迹象 | phishing and social engineering | 网络钓鱼和社会工程 |
| Checking the real address behind a link | 检查链接所指向的 URL | hover over a link and read the real address; a misspelt domain, a missing https, or an address that does not match the sender is a warning sign | 把鼠标悬停在链接上,看它真实的地址;域名拼错、缺少 https、或地址与发件人对不上,都是警示信号 | phishing | 网络钓鱼 |
| Firewall | 防火墙 | sits between the device or network and the outside; checks incoming and outgoing traffic against a set of rules and blocks anything that fails, and can warn the user | 位于设备或网络与外部之间;按一组规则检查进出的流量,拦截不符合规则的流量,并可向用户发出警告 | hacking, malware, unwanted traffic (helps with DDoS) | 黑客入侵、恶意软件、不需要的流量(对 DDoS 也有帮助) |
| Privacy settings | 隐私设置 | controls on browsers, apps and social networks that limit who can see a profile and what data is collected, for example a "do not track" setting | 浏览器、应用和社交网络上的控件,用来限制谁能看到某个资料、以及收集哪些数据,例如"请勿追踪"设置 | unwanted collection and sharing of personal data | 个人数据被不当收集和分享 |
| Proxy-server | 代理服务器 | stands in front of the web server, on the user’s side; forwards requests, keeps the user’s own IP address out of sight, filters traffic, and takes the hit if an attack is aimed at the server | 位于用户与网页服务器之间;转发请求、隐藏用户的 IP 地址、过滤流量,并在针对服务器的攻击中首当其冲 | DDoS, hacking, and keeps the user's identity hidden | DDoS、黑客入侵,并隐藏用户身份 |
| Secure socket layer (SSL) | 安全套接层(SSL) | a protocol that encrypts data between the browser and the web server; the server sends the browser its SSL certificate, the browser checks it, then the encrypted transfer begins (shown by https and the padlock) | 一种在浏览器与网页服务器之间加密数据的协议;服务器把它的 SSL 证书发给浏览器,浏览器检查通过后,加密传输才开始(由 https 和锁形图标表示) | data interception | 数据拦截 |
Try it yourself
动手试试
Follow an SSL connection
跟踪一次 SSL 连接
Step through what happens when a browser opens a page secured with SSL. Watch which side sends the certificate.
逐步走一遍:当浏览器打开一个用 SSL 保护的网页时会发生什么。注意是哪一方发送证书。
Explainer · 5.3.2
讲解 · 5.3.2
Firewall vs proxy server
防火墙与代理服务器
Markers report that candidates can describe a firewall in general terms but cannot say what a proxy server does that a firewall does not. They overlap, but they are not the same.
考官指出,考生能笼统地描述防火墙,却说不出代理服务器能做而防火墙做不到的事。二者有重叠,但并不相同。
| Firewall | 防火墙 | Proxy server | 代理服务器 | ||
|---|---|---|---|---|---|
| Where it sits | 位置 | between the device or network and the outside network | 设备或网络与外部网络之间 | in front of the web server, on the user’s side | 用户与网页服务器之间 |
| Main job | 主要职责 | checks traffic against rules and blocks what fails | 按规则检查流量,拦截不符合规则的 | forwards the user's requests to the web server on their behalf | 代表用户把请求转发给网页服务器 |
| Only the proxy does this | 只有代理能做 | – | – | keeps the user’s own IP address hidden from the web server; caches pages for faster repeat access; takes the hit when an attack is aimed at the server | 隐藏用户的 IP 地址;缓存网页,加快重复访问;在针对服务器的攻击中首当其冲 |
If a question asks what a proxy server does that a firewall does not, the safe answer is it keeps the user’s IP address hidden and it can cache web pages.
如果题目问代理服务器能做而防火墙做不到的事,稳妥的回答是它隐藏用户的 IP 地址,以及它可以缓存网页。
Try it yourself
动手试试
Firewall or proxy?
防火墙还是代理?
Tap each task to tag it as one a firewall does or one only a proxy server does, then check. (Some are done by both; tag those as firewall.)
点击每项任务,把它标记为防火墙会做的、还是只有代理服务器会做的,然后检查。(有些两者都会做,把这些标为防火墙。)
Check your understanding
自测
How does a brute-force attack work?
暴力破解攻击是如何实施的?
Check your understanding
自测
Which attack needs the user to click a link before it can work?
哪种攻击需要用户先点击一个链接才能奏效?
Check your understanding
自测
In an SSL connection, who sends the certificate to whom?
在 SSL 连接中,是谁把证书发给谁?
Common mistakes
常见错误
5.3.1 and 5.3.2
考官针对 5.3.1 和 5.3.2 报告了以下模式
RecurringA brute-force attack is described only as "guessing the password". The process mark needs the method: software tries one combination of characters after another, automatically, until one matches.
反复出现暴力破解攻击被仅仅描述成"猜密码"。过程分需要方法:软件自动地一个接一个尝试字符组合,直到某个相符。
Phishing and pharming get mixed up. Markers see pharming described as the user clicking an email link (that is phishing), and phishing described as software installed on the computer (it is not). Phishing needs a click; pharming redirects the connection with no action from the user.
网络钓鱼和域欺骗被混淆。考官看到有人把域欺骗描述成"用户点击邮件链接"(那是网络钓鱼),把网络钓鱼描述成"在计算机上安装的软件"(并不是)。网络钓鱼需要点击;域欺骗则在用户毫无动作的情况下改变连接的去向。
Hacking, phishing and social engineering are called "malware". Malware is software that is installed and runs on the device. Also, anti-virus is not a type of malware, and a question that asks for a security solution is not answered with a threat (for example "virus").
黑客入侵、网络钓鱼和社会工程被叫成"恶意软件"。恶意软件是安装并运行在设备上的软件。另外,杀毒软件不是一种恶意软件;题目问的是安全防护措施时,不能用一种威胁(例如"病毒")来回答。
On firewalls, answers say it "blocks hackers and malware" without saying how: it checks incoming and outgoing traffic against a set of rules and blocks whatever fails. On proxy servers, answers give generic functions that do not fit the question's context, and miss that a proxy keeps the user’s IP address out of sight. On SSL, the browser is wrongly said to send the certificate to the server; it is the server that sends its certificate to the browser.
关于防火墙,作答说它"拦截黑客和恶意软件",却不说如何做到:它按一组规则检查进出流量,拦截不符合的。关于代理服务器,作答给出与题目情境不符的笼统功能,并漏掉代理会隐藏用户的 IP 地址。关于 SSL,有人错说是浏览器把证书发给服务器;实际是服务器把它的证书发给浏览器。
Too vague: "A brute-force attack is when the hacker guesses your password to get in."
太笼统:"暴力破解攻击就是黑客猜出你的密码进去。"
Right: "Software tries every combination of characters in turn, often working through a list of common passwords first, until it finds the one that matches. The aim is to get into the account."
正确:"软件依次尝试每一种字符组合,通常先跑一遍常见密码表,直到找到相符的那个。目的是进入该账户。"
That is phishing: "Pharming is when you get an email and click the link, and it takes you to a fake website."
那是网络钓鱼:"域欺骗就是你收到一封邮件、点了链接,然后被带到一个假网站。"
Right: "Malicious code on the user's device or on a DNS server changes the IP address a domain name points to, so the browser opens a fake website even when the correct address is typed. The user does nothing."
正确:"用户设备上、或某台 DNS 服务器上的恶意代码,改变了某个域名所指向的 IP 地址,于是即使输入正确地址,浏览器也会打开假网站。用户什么都不用做。"
Go deeper
深入练习
Write the process and the aim for all nine threats
为九种威胁各写出过程和目的
From memory, take each of the nine threats and write one sentence for the process (the steps, with technical terms) and one for the aim. Then do the same for the ten solutions: what it is, and the threat it defends against. Check yourself against the tables in 5.3.1 and 5.3.2.
凭记忆,对九种威胁逐一写出:一句话说过程(步骤,用技术术语),一句话说目的。然后对十种防护措施做同样的事:它是什么、针对哪种威胁。对照 5.3.1 和 5.3.2 的表格核对自己。
Revision questions
复习题
Past-paper style. Write an answer, then reveal the marking points and mark yourself.
采用历年真题风格。写下答案,然后展开评分要点给自己打分。
[3]Describe the steps in a brute-force attack, and state its aim.
[3]描述暴力破解攻击是如何实施的,并说明它的目的。
Marking points
评分要点
- Software automatically tries one combination of characters after another as the password, one attempt after another, often working through a list of common passwords first, until one is accepted.
- Aim: to gain unauthorised access to the account or system.
- 软件自动地把一个又一个字符组合当作密码来尝试,一次接一次,通常先试一份常见密码清单,直到有一个被接受。
- 目的:未经授权地访问该账户或系统。
[4]Explain two differences between phishing and pharming.
[4]解释网络钓鱼与域欺骗之间的两个区别。
Marking points
评分要点
- Any two: phishing needs the user to act (click a link in a fake message), pharming does not; phishing uses a fake email or message, pharming uses malicious code on the device or on a DNS server; phishing links to a fake site, pharming changes the IP address that a correct domain name resolves to.
- 任选两点:网络钓鱼需要用户操作(点击虚假消息中的链接),域欺骗不需要;网络钓鱼使用虚假的电子邮件或消息,域欺骗使用设备上或 DNS 服务器上的恶意代码;网络钓鱼链接到假网站,域欺骗改变正确域名所解析到的 IP 地址。
[4]A company's web server has stopped responding to its customers. Describe how a DDoS attack could have caused this.
[4]某公司的网页服务器不再响应它的客户。描述一次 DDoS 攻击是如何造成这种情况的。
Marking points
评分要点
- The attacker controls many computers (a botnet).
- All of them send requests to the company's web server at the same time.
- The volume of requests uses up the server's bandwidth and processing capacity.
- The server cannot respond to genuine customers' requests, so the service appears to be down.
- 攻击者控制了许多台计算机(一个僵尸网络)。
- 它们同时向公司的网页服务器发送请求。
- 大量请求耗尽了服务器的带宽和处理能力。
- 服务器无法响应真正顾客的请求,所以服务看起来瘫痪了。
[4]Explain how a firewall helps to keep a computer safe from security threats.
[4]解释防火墙如何帮助保护计算机免受安全威胁。
Marking points
评分要点
- A firewall checks the data packets going into and out of the network against a set of rules.
- It blocks any traffic that does not meet the rules, for example from a blocked address or on a blocked port.
- This can stop unauthorised access attempts from outside, and stop a program on the computer sending data out.
- It can also log the traffic and warn of suspicious activity.
- 防火墙对照一套规则检查进出网络的数据包。
- 它拦截任何不符合规则的流量,例如来自被屏蔽地址的、或使用被屏蔽端口的。
- 这可以阻止来自外部的未经授权的访问尝试,也可以阻止计算机上的程序把数据发出去。
- 它还可以记录流量并对可疑活动发出警告。
[3]State three tasks that a proxy server can carry out.
[3]陈述代理服务器可以执行的三项任务。
Marking points
评分要点
- Any three: forward requests to the internet on the user's behalf and hide the user's IP address; cache (store) web pages so repeat requests are served faster; filter or block requests to certain websites; scan traffic for malware; keep a log of web use.
- 任选三点:代表用户向互联网转发请求并隐藏用户的 IP 地址;缓存(存储)网页,使重复请求更快得到响应;过滤或屏蔽对某些网站的请求;扫描流量以查找恶意软件;保留网络使用日志。
Flashcards
记忆卡片
Active recall for this subtopic’s key terms.
针对本子主题关键术语的主动回忆练习。
Keep this subtopic’s practice with you
把这个子主题的练习保存下来
Free account: unlock every revision question and flashcard for 5.3, and every other IGCSE 0478 statement.
免费账户:解锁 5.3 以及所有其他 IGCSE 0478 考纲陈述的全部复习题和记忆卡片。