Penetration Testing Overview

Overview

This 60-minute lesson is designed for a GCSE student studying the unit Cyber Security Essentials. It aligns with the National Curriculum for England, specifically within the Computing programme of study for Key Stage 4. The lesson introduces the concepts of penetration testing, its purpose, and the differentiation between internal and external testing, aiming to build understanding of how these tests identify vulnerabilities in computer systems.

---

National Curriculum Links

• Computing—Key Stage 4 (Ages 14-16)
  • Understand cyber security principles, including penetration testing and vulnerability assessment.
  • Develop knowledge of ethical practices in cyber security.
  • Apply critical thinking to explore ways to protect data and systems from external and internal threats.

Reference:

• NC Computing Programme of Study (DfE, 2013)
• Technical knowledge and understanding section emphasizing computer networks and security

---

Learning Objectives

By the end of the lesson, the student will be able to:

1. Define penetration testing and explain its purpose in cyber security.
2. Distinguish between internal and external penetration testing.
3. Explain how penetration testing helps identify vulnerabilities in systems.
4. Reflect on the ethical considerations and importance of authorised penetration testing within organisations.

---

Equipment & Resources

• Computer with internet access and secure environment for activities
• Whiteboard or digital note-taking app
• Printed handout summarising penetration testing types and workflows
• Case study example of a penetration testing report (simplified for GCSE level)
• Quizzes or interactive polling software (e.g., Kahoot, Mentimeter) to assess understanding

---

Lesson Structure

1. Starter Activity (10 minutes)

Engage with Prior Knowledge & Set Context

• Ask the student: “Have you heard of hackers or cyber attacks? What do you think organisations do to prevent these?”
• Briefly discuss real-world examples of cyber breaches without technical detail (e.g. news headlines).
• Introduce the idea of 'penetration testing' as a proactive security measure before an actual breach occurs.
• Present learning objectives clearly on the board / screen.

---

2. Direct Teaching: What is Penetration Testing? (15 minutes)

• Define penetration testing: “A controlled cyber attack authorised by an organisation to identify weaknesses in their systems.”
• Explain the two main types:
  • External Penetration Testing: Testing from outside the organisation’s network simulating an external attacker.
  • Internal Penetration Testing: Testing from inside the organisation’s network simulating an insider threat or someone who has accessed the internal network.
• Use simple analogies, e.g. comparing pen testing to a security guard trying to break into a building to check for weaknesses.

---

3. Interactive Activity: Vulnerability Identification (15 minutes)

• Present a simplified, hypothetical case study describing a company’s network and potential weaknesses (e.g. weak passwords, outdated software).
• Ask the student to identify which vulnerabilities could be exploited by internal vs external testers.
• Use a visual diagram of network layers and attack points to illustrate this separation.
• Discuss how discovering these vulnerabilities allows the company to fix them before real attackers do.

---

4. Ethical Considerations Discussion (10 minutes)

• Discuss why penetration testing must always be authorised and ethical.
• Explain the consequences of unauthorised testing (illegal hacking).
• Highlight important concepts such as confidentiality and responsible disclosure.
• Encourage the student to consider what rules a penetration tester must follow.

---

5. Assessment & Reflection (10 minutes)

• Use a short quiz or quiz-style questioning covering:
  • Definition of penetration testing
  • Differences between internal and external testing
  • Purpose and benefits of penetration testing
  • Ethical requirements
• Reflect on the lesson by asking: “How do you think penetration testing helps keep information safe?”

---

Differentiation and Extension

• For deeper challenge: Explore basic penetration testing tools in theory (e.g., port scanning) without practical hacking.
• For support: Use more visual aids and scaffold the definitions with simplified sentence starters.
• Further extension: Research famous cyber attacks where penetration testing could have prevented the breach.

---

Cross-Curricular Links

• English: Reading and analysing technical reports and summarising findings.
• Citizenship: Understanding ethics and legal responsibilities in technology use.
• Maths: Logical problem solving applied in identifying system weaknesses.

---

Homework (optional)

• Write a brief paragraph explaining why ethical penetration testing is important in today’s digital world.
• Find a news article about a cyber breach and share how penetration testing might have helped.

---

Prepared for the national curriculum and individual GCSE learner needs to enrich understanding of modern cyber security practice.