Module 02 · Cybersecurity Ethics, Laws, and Responsible Disclosure网络安全伦理、法律与负责任披露

Course Glossary: Introduction to Ethical Hacking Principles课程术语表：道德黑客原理导论

Estimated reading time: 10 minutes
预计阅读时间：10 分钟

Welcome! This alphabetized glossary contains essential terms used in the Introduction to Ethical Hacking Principles course. Understanding these terms is crucial when working in the cybersecurity industry, participating in professional communities, and pursuing further certifications in ethical hacking.
欢迎！本词汇表按字母顺序收录了伦理黑客原则课程中使用的基本术语。在网络安全行业工作、参与专业社区以及追求伦理黑客相关认证时，理解这些术语至关重要。

Term 术语	Definition 定义
Access control 访问控制	Access control consists of security measures that regulate user permissions for resources. 访问控制是指管理资源用户权限的安全措施。
Black hat hacker 黑帽黑客	A black hat hacker is a malicious individual who breaches systems illegally for personal gain or harm. 黑帽黑客是指为了个人利益或损害而非法入侵系统的恶意个人。
Blue teaming 蓝队攻防	Blue teaming involves defensive security operations aimed at protecting systems. 蓝队演练涉及旨在保护系统的防御性安全操作。
Bug bounty program 漏洞悬赏计划	A bug bounty program is an organization initiative that rewards ethical hackers who responsibly identify and report security vulnerabilities. 漏洞悬赏计划是一个组织发起的倡议，旨在奖励那些负责任地识别和报告安全漏洞的道德黑客。
California Consumer Privacy Act (CCPA) 加利福尼亚州消费者隐私法（CCPA）	The California Consumer Privacy Act is a California law that enhances privacy rights and consumer protections. 加州消费者隐私法案是一项加州法律，旨在增强隐私权和消费者保护。
Case study 案例研究	A case study analyzes real-world cybersecurity incidents in-depth to illustrate best practices and lessons learned. 案例研究深入分析现实世界的网络安全事件，以说明最佳实践和经验教训。
Code of conduct 行为准则	A code of conduct consists of ethical guidelines that outline the expected professional behavior of ethical hackers, including explicit authorization, confidentiality, avoidance of disruption, legal compliance, and accurate reporting. 行为准则包括道德指南，概述了道德黑客的预期职业行为，包括明确授权、保密、避免干扰、遵守法律和准确报告。
Computer Fraud and Abuse Act (CFAA) 计算机欺诈与滥用法案（CFAA）	The Computer Fraud and Abuse Act is a U.S. federal law that criminalizes unauthorized access to computer systems. 计算机欺诈与滥用法案是一部美国联邦法律，将未经授权访问计算机系统定为犯罪行为。
Compliance 合规	Compliance refers to the adherence to relevant laws, regulations, guidelines, and standards. 合规是指遵守相关法律、法规、指南和标准。
Covering tracks 清理痕迹	Covering tracks refers to actions taken by attackers to hide their intrusion and evade detection. 清理痕迹是指攻击者采取隐藏其入侵并逃避检测的行为。
Cyberterrorism 网络恐怖主义	Cyberterrorism encompasses cyberattacks aimed at causing widespread disruption or fear. 网络恐怖主义包括旨在造成广泛混乱或恐慌的网络攻击。
Cyberthreat 网络威胁	A cyberthreat is any malicious attempt to damage, disrupt, or gain unauthorized access to digital infrastructure or services. 网络威胁是指任何恶意试图损害、中断或未经授权访问数字基础设施或服务的企图。
Cybersecurity law 网络安全法	Cybersecurity law encompasses regulations and laws designed to protect systems, networks, and data from cyberthreats. 网络安全法包括旨在保护系统、网络和数据免受网络威胁的法规和法律。
Dependency confusion 依赖混淆	Dependency confusion is a supply chain attack that exploits the confusion between internal and external software package names. 依赖混淆是一种利用内部和外部软件包名称之间的混淆进行的供应链攻击。
Encryption 加密	Encryption involves converting data into secure code to prevent unauthorized access. 加密涉及将数据转换为安全代码，以防止未经授权的访问。
Ethical hacking 道德黑客攻击	Ethical hacking is the authorized practice of penetrating systems to identify security weaknesses. 道德黑客攻击是指经过授权渗透系统以识别安全弱点的行为。
Exploit 漏洞利用	An exploit is a method or software attackers use to exploit vulnerabilities. 漏洞利用是指攻击者用来利用漏洞的方法或软件。
Firewall 防火墙	A firewall is a network security system that monitors and filters traffic based on predefined rules. 防火墙是一种基于预定义规则监控和过滤流量的网络安全系统。
General Data Protection Regulation (GDPR) 通用数据保护条例（GDPR）	The General Data Protection Regulation is an EU regulation that protects the privacy and security of personal data. 通用数据保护条例是一项欧盟法规，旨在保护个人数据的隐私和安全。
Grey hat hacker 灰帽黑客	A grey hat hacker is an individual who finds and discloses vulnerabilities without explicit permission but typically without malicious intent. 灰帽黑客是指在不获得明确许可的情况下发现并披露漏洞，但通常没有恶意意图的个人。
Hacker classification 黑客分类	Hacker classification refers to categories of hackers defined by intent, legality, and methods, such as white hat, black hat, and gray hat. 黑客分类是指根据意图、合法性和方法定义的黑客类别，例如白帽黑客、黑帽黑客和灰帽黑客。
Hacker motivation 黑客动机	Hacker motivation refers to the reasons hackers engage in cyberactivities, such as financial gain, curiosity, political protest, espionage, or revenge. 黑客动机是指黑客从事网络活动的原因，例如经济利益、好奇心、政治抗议、间谍活动或报复。
Hacktivism 黑客行动主义	Hacktivism is hacking motivated by political or social causes. 黑客行动主义是指出于政治或社会原因而进行的黑客活动。
Information security 信息安全	Information security protects digital and analog data from unauthorized access or modification. 信息安全保护数字和模拟数据免受未经授权的访问或修改。
Insider threat 内部威胁	An insider threat refers to security risks from authorized users who exploit their access. 内部威胁是指来自利用其访问权限的授权用户的安全风险。
Intrusion detection system (IDS) 入侵检测系统（IDS）	An intrusion detection system consists of systems designed to detect unauthorized or anomalous network activities. 入侵检测系统由设计用于检测未经授权或异常网络活动的系统组成。
Intrusion prevention system (IPS) 入侵防御系统（IPS）	An intrusion prevention system is a security solution that detects and actively blocks threats. 入侵防御系统是一种安全解决方案，用于检测并主动阻止威胁。
Legal boundaries 法律边界	As defined by law, legal boundaries refer to the scope and limitations within which ethical hacking must operate. 根据法律定义，法律边界是指道德黑客活动必须运作的范围和限制。
Legal pitfalls 法律陷阱	Legal pitfalls are risks of unintentionally breaking laws or regulations during cybersecurity activities. 法律陷阱是指在网络安全活动中无意违反法律法规的风险。
Malware 恶意软件	Malware is malicious software created to disrupt, damage, or gain unauthorized system access. 恶意软件是指为了破坏、干扰或获取未经授权的系统访问权限而创建的恶意软件。
Nation-state hacking 国家行为者黑客攻击	Nation-state hacking refers to cyberoperations conducted or sponsored by governments, often for espionage or strategic advantage. 国家行为者黑客攻击是指由政府进行或资助的网络行动，通常用于间谍活动或战略优势。
Penetration testing 渗透测试	Penetration testing involves simulated cyberattacks conducted with authorization to test system security. 渗透测试是指经过授权进行的模拟网络攻击，用于测试系统安全性。
Phishing 网络钓鱼	Phishing involves fraudulent attempts to obtain sensitive personal information, typically via email. 网络钓鱼是指通过电子邮件等手段进行欺诈性尝试，以获取敏感个人信息的行为。
Ransomware 勒索软件	Ransomware is malware that encrypts victim data and demands payment to restore access. 勒索软件是一种加密受害者数据并要求支付赎金以恢复访问权限的恶意软件。
Red teaming 红队演练	Red teaming consists of simulated offensive attacks to evaluate organizational security defenses. 红队演练包括模拟进攻性攻击以评估组织安全防御。
Responsible disclosure 负责任的披露	Responsible disclosure involves reporting vulnerabilities confidentially to affected organizations, allowing them time to remediate before public disclosure. 负责任的披露涉及向受影响组织秘密报告漏洞，让他们有时间在公开披露之前进行补救。
Risk awareness 风险意识	Risk awareness involves understanding cybersecurity risks and their implications. 风险意识涉及理解网络安全风险及其影响。
Script kiddies 脚本小子	Script kiddies are inexperienced attackers who use pre-made hacking tools without deep technical knowledge. 脚本小子是指缺乏深入技术知识，使用现成黑客工具进行攻击的无经验攻击者。
Security report writing 安全报告撰写	Security report writing involves the preparation of detailed and actionable reports on security assessments and vulnerability findings. 安全报告撰写涉及准备关于安全评估和漏洞发现的详细且可操作的报告。
Security reporting 安全报告	Security reporting encompasses the clear and effective documentation and communication of security vulnerabilities and findings. 安全报告包括对安全漏洞和发现进行清晰有效的文档记录和沟通。
Social engineering 社会工程学	Social engineering involves manipulative tactics used to deceive individuals into revealing sensitive information. 社会工程学涉及用于欺骗个人以泄露敏感信息的操纵性策略。
Structured Query Language (SQL) injection 结构化查询语言（SQL）注入	Structured Query Language injection is a cyberattack method where malicious SQL statements are inserted into entry fields to exploit database vulnerabilities. 结构化查询语言注入是一种网络攻击方法，通过在输入字段中插入恶意 SQL 语句来利用数据库漏洞。
Two-factor authentication (2FA) 双因素认证（2FA）	Two-factor authentication is a security method that requires two verification forms to authenticate identity. 双因素认证是一种安全方法，需要两种验证形式来验证身份。
Vulnerability assessment 漏洞评估	Vulnerability assessment is the process of systematically identifying and classifying security weaknesses. 漏洞评估是系统性地识别和分类安全弱点的过程。
Vulnerability disclosure 漏洞披露	Vulnerability disclosure involves reporting identified vulnerabilities with recommendations for remediation. 漏洞披露涉及报告已识别的漏洞并提出修复建议。
Weak authentication 弱认证	Weak authentication refers to insufficient security measures that allow unauthorized access. 弱密码认证是指安全措施不足，允许未经授权的访问。
White hat hacker 白帽黑客	A white hat hacker is an ethical cybersecurity professional who identifies and addresses vulnerabilities legally and responsibly. 白帽黑客是指通过合法和负责任的方式识别和解决漏洞的道德网络安全专业人士。
Zero-day vulnerability 零日漏洞	A zero-day vulnerability is a security flaw unknown to software creators during exploitation. 零日漏洞是指在利用过程中，软件创作者未知的安全缺陷。