It is easy to recognize the need for improved network security just by monitoring the news. Every few months, there is a new story about large companies falling victim to attacks and losing huge amounts of private data and intellectual property. No industry is exempt. Companies in the financial, retail, entertainment, energy, and technology industries have all been attacked.
只要留意新聞，就能輕易發現改善網路安全的必要性。每隔幾個月，就會出現一則大型企業遭受攻擊、損失大量私密資料與智慧財產的新聞。沒有任何產業能倖免。金融、零售、娛樂、能源及科技產業的企業都曾遭受攻擊。
Attackers are not limited to individuals or small teams of hackers. Organized crime and even national governments are often implicated in attacks. Attackers today are exceedingly clever and devious and have vast support through funding and resources.
攻擊者不僅限於個人或小型駭客團隊。有組織的犯罪集團，甚至國家政府，也經常涉入攻擊事件。今日的攻擊者極為狡猾且詭計多端，並擁有龐大的資金與資源支援。
As a defender, you must not be restricted by preconceptions on how things are designed to work or strict classification of known network threats. Attackers do not restrict themselves; they are creative thinkers and combine old and new techniques to produce unique new threats. As a defender, you too must be prepared to think outside the box and evolve to respond to the ever-changing threat landscape.
身為防禦者，你不能被事物「應該」如何運作的既定觀念，或已知網路威脅的嚴格分類所侷限。攻擊者不會自我設限；他們是富有創造力的思考者，會結合新舊技術，製造出獨特的新威脅。身為防禦者，你也必須做好跳脫框架思考的準備，並不斷演進，以因應不斷變化的威脅態勢。
Here are some key security concepts that will help you as you learn about today's threat landscape:
以下是一些關鍵安全概念，將有助於你了解當今的威脅態勢：
- Threat: Any circumstance or event with the potential to cause harm to an asset in the form of destruction, disclosure, adverse modification of data, or denial of service (DoS). An example of a threat is malicious software that targets workstations.威脅（Threat）：任何可能對資產造成損害的情況或事件，形式包括破壞、洩露、對資料的不當修改，或阻斷服務（DoS）。以鎖定工作站的惡意軟體為例，即為一種威脅。
- Vulnerability: A weakness that compromises either the security or the functionality of a system. Weak or easily guessed passwords are considered vulnerabilities.弱點（Vulnerability）：危及系統安全性或功能性的弱點。容易被猜到或強度不足的密碼即被視為一種弱點。
- Exploit: A mechanism that uses a vulnerability to compromise the security or functionality of a system. An example of an exploit is malicious code that gains internal access. When a vulnerability is disclosed to the public, attackers often create a tool that implements an exploit for the vulnerability. If they release this tool or proof of concept code to the internet, other less-skilled attackers and hackers (the so-called script kiddies) can then easily exploit the vulnerability.利用（Exploit）：利用某項弱點來危害系統安全性或功能性的機制。取得內部存取權的惡意程式碼即為利用（exploit）的一例。當某項弱點被公開揭露後，攻擊者通常會建立一個工具，實作出針對該弱點的利用手法。如果他們將此工具或概念性驗證程式碼發佈到網際網路上，其他技術較差的攻擊者及駭客（所謂的腳本小子，script kiddies）便能輕易利用該弱點。
- Risk: The likelihood that a particular threat using a specific attack will exploit a particular vulnerability of an asset that results in an undesirable consequence.風險（Risk）：特定威脅利用特定攻擊，成功利用資產某項弱點，並導致不良後果的可能性。
- Mitigation techniques: Methods and corrective actions to protect against threats and different exploits, such as implementing updates and patches, to reduce the possible impact and reduce risks.緩解技巧：防範威脅與各種利用手法的方法及矯正措施，例如安裝更新與修補程式，以降低可能的影響並降低風險。