Test your own locks
A locksmith is hired to try to open your shop door. They find the back door is weak. You fix it before a thief finds it.
That locksmith is a friend. A stranger trying the same door at night is a criminal. The difference is permission.
Today you learn four defences. One is checking an API (a way for programs to share data). The others are a VPN, port scanning and penetration testing (an allowed test break-in).
By the end of this lesson
Note
I can explain the purpose, benefit and drawback of API certification, VPNs, port scanning and penetration testing.
Key words
| Word | What it means | Example |
|---|---|---|
| API | Application programming interface: a way for one program to ask another for data. | |
| Certificate | A digital document that proves who owns a service. | |
| Certification | Checking and approving that a service is who it says it is. | |
| Network | Computers joined together so they can share data. | |
| VPN | Virtual private network: a private, scrambled tunnel across the internet. | |
| Port | A numbered door on a computer for one kind of traffic. | port 443 for secure web pages |
| Port scanning | Checking which ports on a computer are open. | |
| Penetration testing | A planned, allowed attempt to break into a system to find its weaknesses. | |
| Ethical hacking | Testing a system with permission to help the owner fix it. | |
| Unethical hacking | Breaking into a system without permission. | |
| Scope | The part of a system a tester is allowed to test. | |
| Report | A written list of what was found and how to fix it. |
The cells students fill in are left blank in this preview.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Only test your own lab
Warning
Scanning or testing a system without written permission is a crime under the Computer Misuse Act 1990. The optional labs are your own private copy. Never scan the college, a shop or a home Wi-Fi.
Cycle 1: API certification
An API lets programs share data. A shop site may ask a bank's API to take a payment.
How does the shop know the API is the real bank? A certificate proves who owns it. Certification means the certificate is checked and trusted before any data is sent.
Purpose: stop fake services and listeners. Benefit: you know who you talk to. Drawback: certificates expire and must be renewed.
VPNs
A VPN makes a private tunnel across the internet. Everything inside is scrambled.
A worker at home uses it to reach the college network as if they were in the building. On open Wi-Fi it hides your traffic from others.
Benefit: privacy on a public network. Drawback: it can slow the connection, and the VPN provider can see your traffic.
Check: APIs and VPNs
Have a go
Check: APIs and VPNs
4 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.