A front door check for every device
A caretaker walks round a building each night and tries every door. One is unlocked. He locks it before anyone gets in.
A scan does the same for computers. It tries every door and lists the ones that are open.
By the end of this lesson
Note
I can say what scanning for weak points is, and read the result of a port scan and a device scan.
Key words
| Word | What it means |
|---|---|
| Vulnerability scan | a tool that checks systems for weak points and lists what it finds |
| Vulnerability | a weak point that an attacker can use |
| Port | a numbered door on a device that a service listens at |
| Port scan | a check that finds which ports on a device are open |
| Device scan | a check that finds every device on a network and what it runs |
| Network | computers and devices linked so they can share data |
| Risk register | a table that lists every risk with its rating, owner and action |
| Permission | the right to do something, given by the owner |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Two kinds of scan
A port scan asks one device: which ports are open? An open port means a service is listening, and an attacker may be able to talk to it.
A device scan asks the whole network: which devices are here, and what do they run? It finds devices nobody knew about.
Well-known ports and what they mean
| Port | Service | Is an open port a worry? |
|---|---|---|
| 22 | Secure remote login | Only if it is needed and well protected |
| 23 | Telnet, an old remote login with no protection | Yes: it sends passwords as plain text |
| 80 | Web, not encrypted | Only for a public web page |
| 443 | Web, encrypted | Normal for a web server |
| 3389 | Remote desktop | Yes if it faces the internet |
The cells students fill in are left blank in this preview.
Only scan what you may scan
Important
Scanning a system you do not own, without permission, can break the law. Scan your own organisation, with the owner's written permission. Nothing in this lesson scans a real system.