Subject: Digital Technology Class: SS2 Topic: Cyber Security: Ethical Hacking and Penetration Testing
In our modern world, we live a significant portion of our lives online. From social media and online banking to school portals and government databases, our data is everywhere. Cyber Security is the practice of protecting systems, networks, and programs from digital attacks. These attacks are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users; or interrupting normal business processes.
As SS2 students, it is vital to understand that as technology evolves, so do the methods used by "threat actors" (hackers). To defend against these threats, we must learn to think like them—this is where Ethical Hacking and Penetration Testing come into play.
Ethical Hacking involves an authorized attempt to gain unauthorized access to a computer system, application, or data. Unlike malicious hacking, ethical hacking is performed with the owner’s permission. The goal is to find vulnerabilities (weaknesses) that a malicious hacker could exploit.
Ethical hackers are often called "White Hat Hackers." They use the same tools and techniques as "Black Hat Hackers" (criminals), but they do so to improve security rather than cause harm. Think of an ethical hacker as a security consultant who is hired by a bank to try and break into their vault. If the consultant succeeds, they don't take the money; instead, they tell the bank exactly how they got in so the bank can fix the hole in the wall.
While ethical hacking is a broad term covering all hacking techniques used for good, Penetration Testing is a specific, structured procedure. It is a simulated cyber-attack against your computer system to check for exploitable vulnerabilities.
In the context of Nigeria's growing Fintech industry (like OPay, Flutterwave, or GTBank apps), penetration testing is mandatory. Companies must regularly "test" their apps to ensure that hackers cannot steal customers' money or personal BVN (Bank Verification Number) details.
Types of Penetration Testing:
Imagine your school has an online portal where students check their exam results. An ethical hacker might be hired to see if a student could "inject" code into the website to change their grades from a 'C' to an 'A'. By finding this weakness, the hacker helps the school developer rewrite the code to make it "injection-proof."
During a "Black Friday" sale, millions of Nigerians use their debit cards on e-commerce sites. A penetration tester will simulate a "Man-in-the-Middle" (MITM) attack to see if they can intercept the card details as they travel from the user's phone to the company’s server. If they can intercept it, the encryption is too weak and must be upgraded.
Have you ever seen a "hacked" Instagram or Facebook account? Ethical hackers often work with these platforms to find "bugs" in the "Forgot Password" system. If a hacker finds a way to bypass the 2-factor authentication (2FA) using a specific trick, they report it to Meta (the owners of Facebook) and get paid a "Bug Bounty."
You don’t need to be a professional to apply the principles of ethical hacking to your own life. Use these steps to "pen-test" your own digital footprint:
Audit Your Passwords:
Test Your Email for Leaks:
haveibeenpwned.com. Enter your email address.Inspect Website Security (The Padlock Rule):
HTTPS or just HTTP?Objective: To analyze and improve the security of your home Wi-Fi network.
Materials Needed:
Procedure:
192.168.1.1 or 192.168.0.1 in a browser).
Understanding ethical hacking opens doors to some of the highest-paying jobs globally and in Nigeria.
This lesson isn't just about computers; it’s about Integrity. In Nigeria, the Cybercrime Act of 2015 makes unauthorized access to systems a punishable offense with heavy fines and jail time.
Option A: The "Phishing" Detective (Case Study)
Analyze the following text message:
"Dear Customer, your BVN has been deactivated due to a system upgrade. Click here www.bank-verify-nignet.com to reactivate now to avoid account freezing."
Option B: The Security Policy Creator You are the "IT Manager" for a new small business in your neighborhood. Write a 5-point "Digital Security Policy" for the employees to follow to ensure the business doesn't get hacked. (Hint: Think about passwords, public Wi-Fi, and email attachments).