Paid to break in, with permission
A school asks a security firm: "Try to get into our Wi-Fi." The firm says yes. It tries. It gets in using a weak password and writes a report.
This is a penetration test. It is legal only because the school said yes first.
By the end of this lesson
Note
I can put the seven stages of a penetration test in order and say what happens in each.
Key words
| Word | What it means |
|---|---|
| Penetration testing | a test where an approved person tries to break into a system to find its weak points |
| Scope | what may be tested and what may not |
| Scanning | checking a system to see which devices and open doors it has |
| Vulnerability | a weak point that an attacker can use |
| Exploitation | using a weak point to get in, to show the harm it could do |
| Wireless | using radio waves, such as Wi-Fi, instead of cables |
| Network | computers and devices linked so they can share data |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Only test with permission
Important
Trying to get into a system without permission is a crime in the UK, under the Computer Misuse Act 1990. Never test a system you do not have written permission to test.
Seven stages, in order
- Customer engagement: agree the scope and the rules, in writing.
- Information gathering: collect facts that are already public.
- Discovery and scanning: find the devices and open doors.
- Vulnerability testing: look for known weak points.
- Exploitation: try to use a weak point, carefully.
- Final analysis and review: write the report.
- Use the test results: fix what was found.
Check: put them in order
Have a go
Check: put them in order
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.