The bank hires a burglar
A bank wants to know if its vault (the strong room for money) is safe. So it hires a burglar (a thief who breaks in). The burglar has a signed letter of permission.
The burglar tries to get in, writes a report, and tells the bank what to fix.
The same idea works for computers. Penetration testing means an expert tries to break in, with permission, to find weak points.
Key words
| Word | What it means | Example |
|---|---|---|
| VPN | Virtual private network (a safe link over the internet). It makes an encrypted tunnel for your traffic. | working from home |
| MFA | Multi-factor authentication (proving who you are in two or more different ways). | a password and a phone code |
| Password manager | A program that stores and creates strong passwords for you. | one master password opens the rest |
| Port | A numbered door on a computer that network traffic uses. | port 443 for secure web pages |
| Port scanning | Checking which ports are open on a computer. | a list of open doors |
| Penetration testing | A test where an expert tries to break in, with permission, to find weak points. | a hired burglar |
| Ethical hacking | Hacking with permission, to help the owner. | a pen test |
| Unethical hacking | Hacking without permission, to harm or to steal. | breaking into a school site |
| Scope | What a tester may and may not test. | only these two servers |
| API | A way for one program to ask another program for data. | a weather app asking a weather service |
| SQL injection | Typed text that changes the question a program asks its stored data. | a search box that shows secrets |
| Certification | A check by an independent group that something meets a standard. | a checked and approved API |
The cells students fill in are left blank in this preview.
Quick check: which tool?
Have a go
Quick check: which tool?
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Six tools: purpose, benefit, drawback
| Tool | Purpose | Benefit | Drawback |
|---|---|---|---|
| VPN | Make a private encrypted tunnel across the internet | Safe on public Wi-Fi. Lets staff reach work from home | Can slow the connection. You must trust the VPN owner |
| MFA | Ask for two or more different proofs of who you are | A stolen password is not enough | Extra steps. A lost phone is a problem |
| Password manager | Store and create strong, different passwords | No need to remember them all | If the master password is lost or stolen, all the passwords are at risk |
| Certified APIs | Use only APIs that a trusted group has checked against a security standard. Give each program a key | Fewer insecure doors | Checking takes time and money |
| Port scanning | Find open ports that should be shut | Shows weak points early | Attackers scan too. A scan can slow or break a weak system |
| Penetration testing | Try to break in, with permission | Finds weak points before criminals do | Costs money. It shows only what was tested on that one day |
The cells students fill in are left blank in this preview.
Three kinds of proof
| Kind | Meaning | Example |
|---|---|---|
| Something you know | A secret in your head | Password, PIN, passphrase (a password made of several words) |
| Something you have | A thing you hold | A phone, a card, a security key |
| Something you are | A part of your body | Fingerprint, face |
| Not MFA | Two proofs of the SAME kind | A password plus a PIN: both are things you know |
The cells students fill in are left blank in this preview.
Ethical or unethical?
data-callouts.warning.label
Ethical hacking needs written permission and a clear scope: what you may test, and when. Without permission it is unethical hacking, and a crime under the Computer Misuse Act 1990. A good reason does not change that.