Make It Happen: Third level

Know

• MIH-3-CY-K1

  Passive reconnaissance gathers information from public sources without contacting or accessing the target system.

  Learn card: Passive reconnaissance

  Reconnaissance (recon) is the information-gathering stage of an attack or a security test. Before trying to get in, attackers and testers find out as much as they can.

  Passive reconnaissance uses only information that is already public, such as a company's website, job adverts, news stories and public records. It never contacts or touches the target's own systems, so the target cannot tell it is happening.

  Small details, like an email address format or the software named in a job advert, can help an attacker plan their next step.

  Which of these is passive reconnaissance?

  Scanning a company's network Reading a company's public website Trying passwords on a login page Plugging a laptop into their network

  What makes reconnaissance passive?

  It is done slowly It never contacts or touches the target's systems It is done at night It uses a special program

  Check my answers
• MIH-3-CY-K2

  Open-source intelligence (OSINT) finds useful information in public sources, such as websites, news, social media and satellite images, that can reveal weaknesses.

  Learn card: Open-source intelligence (OSINT)

  Open-source intelligence (OSINT) means finding useful information in sources anyone can see: websites, news articles, social media, public records and satellite or map images.

  On its own each piece might seem harmless: a pet's name, a team night out, a photo of a staff pass. Put together, they can reveal weaknesses, such as answers to security questions or when a building will be empty.

  Security testers use OSINT to show organisations what they and their staff are giving away, so they can share less.

  In OSINT, "open source" means the information...

  is free software is publicly available was stolen comes from a password list

  Which is an OSINT source?

  A public social media post A company's private email A locked staff database Someone's diary at home

  Check my answers
• MIH-3-CY-K3

  Active reconnaissance collects information by communicating with a system directly, for example scanning a network for devices and open ports.

  Learn card: Active reconnaissance

  Active reconnaissance gathers information by communicating with the target's systems directly. A common example is scanning a network to find which devices are switched on and which ports are open.

  A port is like a numbered door into a device, used by a particular service such as web pages or file sharing. An open port that shouldn't be open can be a way in.

  Because a scan sends traffic to the target, the target can notice it. Doing it without permission can be against the law. The Recon Desk lab has a recorded demo of a scan you can watch.

  What makes reconnaissance active?

  It uses a fast computer It contacts the target's systems directly It only uses news articles It is done by a team

  Scanning a network to find open ports is...

  passive reconnaissance active reconnaissance encryption a backup

  Check my answers

  Builds on: SYS-3 Computing Science: IP addresses, protocols and packets (p.17-18)

• MIH-3-CY-K4

  In security testing an organisation hires someone, such as an ethical hacker, to try to break in so that weaknesses can be found and fixed.

  Learn card: Security testing

  In a security test (often called a penetration test or pen test), an organisation hires someone, such as an ethical hacker, to try to break into its systems.

  The tester uses the same kinds of techniques as a real attacker, but with permission, and reports every weakness they find so it can be fixed before a criminal finds it.

  It is a real career. Security testers work for specialist companies, banks, governments and tech firms.

  Why does an organisation hire an ethical hacker?

  To attack its competitors To find its weaknesses so they can be fixed To delete old files To write its website

  An ethical hacker is different from a criminal hacker because they...

  use different computers have permission and report what they find never use tools only work at night

  Check my answers
• MIH-3-CY-K5

  Security testing has to be repeated regularly because new weaknesses and threats keep appearing.

  Learn card: Test again, and again

  A system that was secure last year might not be secure today. New weaknesses are found in software all the time, attackers invent new methods, and organisations change their systems, staff and suppliers.

  That is why security testing is not a one-off. Organisations test regularly, and again after big changes such as a new website or a new network.

  Each test should check that the problems found last time were really fixed.

  Why should security testing be repeated regularly?

  Because testers get bored Because new weaknesses and threats keep appearing Because the law says once a week It doesn't need to be

  Which change might create a new weakness?

  Installing new software Turning the lights off Painting the office Ordering lunch

  Check my answers
• MIH-3-CY-K6

  Security testing is legal and ethical only when the tester has permission, there are clear boundaries and the purpose is defensive.

  Learn card: When is hacking legal?

  In the UK, the Computer Misuse Act 1990 makes it a crime to get into a computer, account or data without permission, even if you only look and change nothing.

  Security testing is legal and ethical only when three things are true. The owner has given written permission. There are clear boundaries (the scope) about what may be tested and how. And the purpose is defensive: to find and fix weaknesses, not to cause harm.

  Testers agree the rules before they start, and stop at once if they reach anything outside the scope.

  Which makes security testing legal and ethical?

  Being very careful Permission, clear boundaries and a defensive purpose Not changing anything Only testing small companies

  Your friend says it's fine to try logging into another pupil's account "just to look". Is it?

  Yes, if nothing is changed No: it is unauthorised access, which is a crime Yes, if it's a joke Yes, if they're your friend

  Check my answers

  Foundations: FND-DW-2-1

Do

• MIH-3-CY-D1

  Carry out passive reconnaissance on a system safely and ethically.

  Recon Desk

• MIH-3-CY-D2

  Use OSINT to gather information on a person, organisation or computer system.

  OSINT Board

  Foundations: FND-DW-2-2

Includes and notes

• Note: The framework suggests exploring hacking techniques through educational network simulations, cyber labs and ethical hacking exercises. Every lab here is a simulation against fictional targets.

Reflect