Our external attack was done in two stages. The first stage undertaken on all 15 agencies was a scan of agency Internet sites using publically available scanning software downloaded free from the Internet. The software is typically used by network administrators to run internal security scans to identify weaknesses and follow up any exceptions and problems.