4. Practicals

Hands-on security tasks based on your teacher’s practicals. Each one links to the lesson it supports.

Before you start

Rules for security practicals. Only scan, test or attack the lab systems your teacher gives you. Never use these tools on college, home or public networks, or on anyone else’s account. Unauthorised access is a criminal offence under computer misuse law.
  1. Spot the phish
  2. How strong is that password?
  3. Diffie-Hellman key exchange
  4. Hashing and integrity
  5. Linux users, groups and permissions
  6. Nmap in the lab network
  7. Configure a firewall in Packet Tracer
  8. Perimeter security proposal
  9. Security policy for a small business
  10. Cisco Cybersecurity Essentials (optional)

Practical 1: Spot the phish

30 minLesson T3
  1. Your teacher gives you six messages (emails, texts and a phone script). Some are genuine, some are social engineering.
  2. For each, decide genuine or attack. If an attack, name the type (phishing, spear phishing, smishing, vishing, pharming, USB baiting).
  3. List every red flag you found: sender, urgency, greeting, links, attachments, requests.
  4. Write the one action a member of staff should take for each attack.
Keep: Your completed table: good revision for 8.2.1.

Practical 2: How strong is that password?

30 minLesson T2
  1. Work out the number of combinations for a 6-letter lower-case password (26⁶) and an 8-character password using all 94 keyboard characters (94⁸).
  2. Compare with four random words from a 7,776-word list (7,776⁴). Which is easier to remember? Which is stronger?
  3. Read the NCSC password guidance your teacher provides. List three recommendations it makes.
  4. Write a password policy for a small business in five rules, and justify each.
Check it works: Your numbers match the brute-force chart on the Learn page.
Keep: Your calculations and policy.

Practical 3: Diffie-Hellman key exchange

30 minLesson M2
  1. Open your teacher’s Diffie-Hellman spreadsheet. Follow the stages with P = 23, G = 9, a = 4, b = 3.
  2. Check Alice sends 6, Bob sends 16, and both reach the shared key 9.
  3. Now choose your own secret numbers with a partner (keep P = 23, G = 5) and repeat on paper.
  4. Explain in two sentences why an eavesdropper cannot easily work out the key.
Check it works: You and your partner reach the same key.
Keep: Your working.

Practical 4: Hashing and integrity

20 minLesson M2
  1. On a lab PC, create a text file and find its hash: certutil -hashfile notes.txt SHA256 (Windows) or sha256sum notes.txt (Linux).
  2. Change one character and hash it again. Compare the two hashes.
  3. Explain how a download site uses a published hash to prove a file has not been tampered with (integrity).
Check it works: The hashes are completely different after a one-character change.
Keep: Screenshots and your explanation.

Practical 5: Linux users, groups and permissions

50 minLesson C2
  1. In a Linux terminal or VM, practise ls -l, pwd, cd, mkdir, cp and mv from the Linux commands practical.
  2. Create a group and two users: sudo groupadd hr, sudo useradd -m -G hr akhan, sudo useradd -m bjones.
  3. Create a folder for HR and set permissions: sudo chown root:hr /srv/hr then sudo chmod 770 /srv/hr.
  4. Log in as each user and test access. Explain which part of IAAA each step shows.
  5. Run last and explain how login history supports accountability.
Check it works: akhan can open the folder; bjones is denied.
Keep: Screenshots with captions.

Practical 6: Nmap in the lab network

60 minLesson M4
  1. Use only the Kali VM and lab DMZ network your teacher provides (10.6.6.0/24). Never scan any other network.
  2. Run nmap -V and man nmap. Complete the options table (-A, -O, -p, -sn, -sS, -sT, -sV, -T, -v, --open).
  3. Discover live hosts: nmap -sn 10.6.6.0/24.
  4. Scan one target for services and versions: nmap -sV 10.6.6.23.
  5. For each open port, name the service and say whether a defender should close it and why.
Check it works: You can explain what each open port means.
Keep: Your options table and findings.

Practical 7: Configure a firewall in Packet Tracer

45 minLesson M5
  1. Build three PCs, a switch and a server: server 1.0.0.1, PCs 1.0.0.2–1.0.0.4, mask 255.0.0.0.
  2. Test ping and web access from every PC.
  3. On the server: Services → Firewall → On. Deny ICMP from 1.0.0.2 and allow ICMP from any other address.
  4. Test again. Then allow only HTTP and explain the effect of a default-deny rule.
Check it works: PC0 cannot ping the server; the others can.
Keep: Screenshots of the rules and tests.

Practical 8: Perimeter security proposal

90 minLesson V3
  1. Read the warehouse scenario (customer entrance, staff door, loading bays, offices, supply closets).
  2. Define the outer perimeter, inner perimeter and interior, and one key vulnerability for each.
  3. Research access-control, monitoring and CCTV products with approximate costs.
  4. Present your recommendations in no more than five slides.
Keep: Your five-slide proposal.

Practical 9: Security policy for a small business

60 minLesson C1
  1. Choose a business: a dental practice, an online shop or an accountancy firm.
  2. List its confidential information and the main threats it faces.
  3. Write a one-page policy covering passwords and MFA, access (roles), backups, updates, staff training and what to do in an incident.
  4. For each rule, name which part of the CIA triad it protects.
Keep: Your policy: ideal revision for extended exam questions.

Practical 10: Cisco Cybersecurity Essentials (optional)

Self-pacedLesson T1
  1. Enrol through your teacher’s Cisco Networking Academy class for the Cybersecurity Essentials course.
  2. Complete the modules on threats, access control and cryptography, including the Packet Tracer activities your teacher sets.
  3. Keep a list of any new terms and add them to your revision notes.
Keep: Your course progress and badge.