It works, but is it safe?
A new branch passes every ping test. All the desks reach the server. The manager is happy.
But a visitor plugs a laptop into a wall socket and reaches the room where the finance server sits. Working is not the same as safe. A security test asks a different question.
By the end of this lesson
Note
I can test a system for security and record the weaknesses I find.
Key words
| Word | What it means | Example |
|---|---|---|
| Requirement | something the system must do or must not allow | |
| Weakness | a flaw that an attacker could use | |
| Port | a numbered door on a device where one service listens | 80 |
| Open port | a port that accepts a connection | |
| Service | a program that waits for other devices to connect to it | |
| Telnet | an old way to log in over a network that sends everything as plain text | |
| Segmentation | splitting a network into parts so one part cannot freely reach another | |
| Network | computers and devices joined together so they can share data | |
| Firewall | a device or program that blocks some messages and lets others through |
The cells students fill in are left blank in this preview.
Starter
Have a go
Starter
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
This is practice
Important
The real Task 2 gives you a network file in the exam board's simulator and sets its own way of recording tests. Here you use real tools in a lab on a network built for practice. Only test networks you are allowed to test.
Start from the requirements
| Requirement for the branch | How you could test it |
|---|---|
| Staff desks can reach the web server on the management network | Connect to port 80 from a desk |
| No other service on the management network is reachable from desks | Probe the other common ports from a desk |
| Desks cannot log in to the management servers with old, unsafe tools | Check that telnet, port 23, is closed |
| Only the services that are needed are running | List what is listening on the server |
The cells students fill in are left blank in this preview.
Set up: a route out of router A
sudo ip netns exec r1 ip route replace 10.0.99.0/24 via 10.0.12.2A command for the lesson’s lab terminal. It is shown here and not run.
Set up: the way back on router B
sudo ip netns exec r2 ip route replace 10.0.1.0/24 via 10.0.12.1A command for the lesson’s lab terminal. It is shown here and not run.
Set up: start two services on the server
sudo ip netns exec mgmt bash -c "nc -l -p 23 -k >/dev/null 2>&1 & nc -l -p 80 -k >/dev/null 2>&1 &"A command for the lesson’s lab terminal. It is shown here and not run.