The unlocked back door
A cleaner finds the back door of a shop unlocked every night. She tells the manager.
The manager asks: can a thief really get in? How much could they take? What do we fix first? Is it fixed now?
Those four questions are a whole assessment in small.
Key words
| Word | What it means |
|---|---|
| Vulnerability | a weak point that an attacker could use |
| Scan | a tool that checks systems for weak points |
| Log | a record a system keeps of what happened |
| Anomaly | something odd that does not fit the normal pattern |
| Exploit | to use a weak point to get in or do harm |
| Remediation | fixing the problem for good |
| Mitigation | an action that makes the harm smaller |
| Escalate | to pass a problem up to someone with more power |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can put the five stages of a vulnerability assessment in order and say what happens at each.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Stages 1 and 2: find, then test
Stage 1, identify. Read the results of scans and logs. Look for an anomaly, such as a server that has not been updated for a year.
Stage 2, analyse. Can the vulnerability really be used? How severe is it? A weak point that nobody can reach matters less than one on the open internet.
Stage 3: find the risks and rank them
One weak point can lead to several risks. An old web server could leak customer data or stop sales.
Write each risk down. Then put the risks in order, worst first. This is prioritisation. The team fixes the worst first.
Stages 4 and 5: fix or soften
Stage 4, remediation. Fix it for good. Update the software, or remove the old hardware or software that has the weak point.
Stage 5, mitigation. Sometimes you cannot fix it yet. Add a countermeasure that makes the harm smaller, such as a rule that blocks outside access.
Check
Have a go
Check
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.