Why defenders do reconnaissance on themselves

Before anyone tries to protect a network, they need to know what an outsider can already see. Reconnaissance is the information-gathering phase of a security evaluation. It comes in two flavors:

• Passive reconnaissance collects information without ever contacting the target. Public DNS records, domain registration, job postings, press releases, and social media are all passive sources. The target never knows you looked.
• Active reconnaissance touches the target directly, for example by sending traffic to its servers. Active work is only ever done with written permission and a defined scope, which is why this module keeps everything passive and simulated.

The collection of everything that is publicly visible about an organization is called its footprint or attack surface. Open-source intelligence, or OSINT, is the practice of building a picture from public sources.

What the sample shows

The simulated lookup above is for a fictional school, Harbor Light Academy, on a reserved documentation domain. Notice two things:

1. The domain record names the organization and its name servers. That is normal and usually fine.
2. The job posting mentions a Windows file server and guest Wi-Fi. That tells an outsider exactly what kinds of systems to expect, before anyone has touched the network.

A defender reads this the same way an attacker would, then asks: what could we stop publishing without hurting our work?

Hosts, ports, and services

A network is a collection of hosts (computers, servers, printers, phones). Each host offers services (a website, file sharing, remote login) and each service listens on a numbered port. An asset map is simply an inventory of which hosts offer which services.

Scanning tools exist to build that inventory. In the sample above, the -sV flag asks the tool to report the service name and version for each open port. We show the output as a static illustration so you can read it the way a network administrator would. Nothing on this page sends traffic anywhere.

Inventory before intrusion

Scanning is often described as an attack step, but for defenders it is the opposite. A school cannot protect a file server it does not know exists. The goal of this phase is:

1. Inventory: list every host and service.
2. Classify: decide which services should be reachable from where. The public website should face the internet. The file server and printer should only be reachable by staff devices.
3. Segment: split the network into zones (guest, staff, servers) so a compromised guest laptop cannot reach the file server.

Reading the sample

Harbor Light Academy’s sample network has three hosts. The web server on 192.0.2.10 is doing what it should. The host at 192.0.2.25 offers both file sharing and remote desktop to the whole network, which is more exposure than it needs. The printer on 192.0.2.40 probably should not be reachable from guest Wi-Fi at all.

Weaknesses, names, and scores

A vulnerability is a weakness that could let something go wrong: an unpatched program, a setting left at its factory default, an old encryption protocol still switched on. Vulnerability assessment is the work of finding these weaknesses and ranking them. It stops there. Proving a weakness can be exploited is a different, tightly controlled activity that is never part of this module.

Two terms you will see everywhere:

• A CVE (Common Vulnerabilities and Exposures) identifier is a name tag for one specific known flaw, such as CVE-2026-00000 (a placeholder, not a real entry). It tells you which flaw.
• A CVSS (Common Vulnerability Scoring System) score rates how severe a flaw is, from 0 to 10. Scores map to words: Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9), and Critical (9.0 to 10.0).

CVSS version 4.0 was released in November 2023 and is the current standard. Version 3.1 is still widely used, so you will see both in real reports. The ideas are the same: higher means more urgent.

Two common root causes

Most findings in a school network trace back to two habits:

1. Missing updates. Vendors publish fixes. Systems that do not receive them stay vulnerable to flaws everyone already knows about. A regular patch cadence (for example, monthly, with emergencies handled sooner) is one of the highest-value defenses there is.
2. Configuration errors. Default passwords, services switched on that nobody uses, and old protocols left enabled. Hardened baselines such as the CIS Benchmarks are published checklists of safe settings.

Reading the sample

The sample report lists five findings for Harbor Light Academy. Notice that the two High findings on 192.0.2.25 both come from the host doing more than it should: default settings plus remote desktop open to everyone. Fixing the configuration solves both.

Assume breach

Good defenders plan for the day something goes wrong. Defense-in-depth means stacking independent layers of protection so that one failure does not become a full compromise. If a password leaks, MFA still stands. If a laptop is infected, segmentation keeps it away from the servers. If a server is compromised, least privilege limits what the attacker can reach from it.

The core controls

• Least privilege. Every person and every account gets only the access needed for their job. A teacher does not need admin rights on the file server. A shared admin login means nobody knows who did what, so each admin gets a named account.
• Multi-factor authentication (MFA). Logging in needs something you know (a passphrase) and something you have (a phone app or a hardware key). A stolen password alone stops working.
• Strong passphrase policy. Length beats complexity rules. A long passphrase that is checked against lists of known breached passwords is far stronger than an eight-character mix of symbols that people reuse.
• Network segmentation. Guest Wi-Fi, staff devices, and servers live in separate zones with rules about who can talk to whom. A flat network, where everything can see everything, lets one infected device reach all the rest.
• Patch cadence. Updates are themselves a control. A monthly schedule plus a fast path for emergencies closes known flaws before they matter.

Reading the sample

The hardening plan above takes each weakness from Harbor Light Academy’s sample findings and places a layer in front of it. Your job in this phase is to do the same mapping in your own words: for each finding you logged, which control addresses it, and what happens if that control fails?

Two audiences, one report

A security report has to work for two very different readers at once. The principal or director needs to know what is at risk and what it will take to fix it, in plain language, in about a minute of reading. The technician needs exact details: which host, which setting, which update, in what order.

A good report serves both with a clear structure:

1. Executive summary. Plain language. The three biggest risks, what they could affect (student records, payroll, the website), and the plan.
2. Scope and methodology. What was evaluated, what was not, and how. For this module: a five-phase, simulated evaluation on a documentation-only network.
3. Findings. A table with each weakness, the affected host, the severity word, and the CVSS score.
4. Prioritized remediation roadmap. The fixes in order, with an owner for each and a sentence on why that order.
5. Appendix. The asset inventory and a glossary for any term a reader might not know.

Priority is the product

The most useful thing a report does is tell people what to do first. Highest score first is a fine default, but weigh exposure too: an internet-facing weakness usually comes before an internal one with the same score, and a fix that closes several findings at once (like the configuration cleanup on 192.0.2.25) is worth doing early.

Ethical disclosure

Real findings are shared privately with the people who can fix them. They are given reasonable time to do so before anything is discussed more widely. This is called responsible disclosure, and it is the norm in the security profession. Publishing a weakness before it is fixed puts real people at risk.