Paying someone to try the locks
A bank asks a locksmith to test its doors. The locksmith writes down every weak lock and gives the bank a report. Nobody calls the police, because the bank asked.
Computer systems have the same idea. This lesson is about testing a computer system with permission, so weaknesses are fixed before a criminal finds them.
By the end of this lesson
Note
I can explain how an organisation arranges a permitted security test and what happens to the findings.
Key words
| Word | What it means |
|---|---|
| Ethical hacker | a security expert who tests systems with permission to help the owner |
| Penetration testing | a permitted test that checks whether weaknesses can really be used |
| Vulnerability | a weakness that could be used to cause harm |
| Permission | written agreement from the owner to carry out the test |
| Scope | what may be tested and what may not |
| Rules of engagement | the agreed rules for how, when and by whom a test is done |
| Firewall | a filter that allows or blocks data by rule |
| Authentication | proving who you are |
| Network | devices joined so they can share data |
The cells students fill in are left blank in this preview.
Starter: what you already know
Have a go
Starter: what you already know
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
First, the everyday defences a manager runs
Before any test, the network already has defences, and the manager looks after them. A firewall is checked so its rules still match what the business needs.
Access controls and user rights are reviewed, so nobody keeps access they no longer need. A VPN (a private, scrambled link across the internet) lets staff reach work safely from home, and only the right accounts may use it.
Defences and the question a manager asks
| Defence | Question to ask |
|---|---|
| Firewall rules | Does each rule still have a reason? |
| Access controls | Is every account in the right group? |
| User rights | Has anyone kept rights from an old job? |
| VPN access | Is the list of people who may use it up to date? |
The cells students fill in are left blank in this preview.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.