Who is really on the other end?
A report page pulls sales figures from a partner shop every hour. One day a fake service pretends to be the partner. It sends numbers that look right, and they are all wrong.
The analyst needs a way to be sure who is sending the data. Today you learn four defences. One is checking an API (a way for programs to share data). The others are a VPN, port scanning and penetration testing (an allowed test break-in).
Key words
| Word | What it means | Example |
|---|---|---|
| API | Application programming interface: a way for one program to ask another for data. | |
| Certificate | A digital document that proves who owns a service. | |
| Certification | Checking and approving that a service is who it says it is. | |
| Network | Computers joined together so they can share data. | |
| Database | An organised store of data that programs can search. | |
| Data warehouse | A big database that holds a firm's data for analysis. | |
| VPN | Virtual private network: a private, scrambled tunnel across the internet. | |
| Port | A numbered door on a computer for one kind of traffic. | port 443 for secure web pages |
| Port scanning | Checking which ports on a computer are open. | |
| Penetration testing | A planned, allowed attempt to break into a system to find its weaknesses. | |
| Ethical hacking | Testing a system with permission to help the owner fix it. | |
| Unethical hacking | Breaking into a system without permission. | |
| Scope | The part of a system a tester is allowed to test. | |
| Report | A written list of what was found and how to fix it. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can explain the purpose, benefit and drawback of API certification, VPNs, port scanning and penetration testing.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Only test your own lab
Warning
Scanning or testing a system without written permission is a crime under the Computer Misuse Act 1990. The optional labs are your own private copy. Only attack the lab. Never scan the college, a shop or a home Wi-Fi.
A certificate shows who owns an API
An API lets programs share data. A report page may ask a partner's API for the day's sales.
How does the report page know the API is the real partner? A certificate proves who owns it. Certification means the certificate is checked and trusted before any data is sent.
Purpose: stop fake services. Benefit: you know who you talk to. Drawback: certificates expire and must be renewed.
A VPN is a private tunnel
A VPN makes a private tunnel across the internet. Everything inside is scrambled.
An analyst at home uses it to reach the firm's data warehouse as if they sat in the office. On open Wi-Fi it hides your traffic from other people.
Benefit: privacy on a public network. Drawback: it can slow the connection, and the VPN provider can see your traffic.
Check: APIs and VPNs
Have a go
Check: APIs and VPNs
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.