Technologies · Year 10

Active learning ideas

Cybersecurity Best Practices for Individuals

Active learning works for this topic because cybersecurity habits form through repetition, not just listening. Students need to feel the tension of a phishing email, see the gaps in their own password habits, and experience the relief of finding a real software update that closes a known flaw.

• ACARA Content Descriptions
• AC9DT10P01

• 25–40 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 40 min · Small Groups

Audit Station: Device Security Checklists

Students rotate through stations to assess passwords, update status, browsing history, and two-factor setups on their devices. They document findings on a checklist template and brainstorm fixes. Groups compare results and prioritize actions.

Develop a personal cybersecurity checklist for online safety.

Facilitation Tip

For Audit Station, provide real devices or lab simulations so students can physically check settings like MFA and update status.

What to look for

Provide students with a scenario: 'You receive an email asking you to click a link to verify your account details immediately.' Ask them to write two sentences explaining why this might be a phishing attempt and one action they should take instead.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Role Play
• 30 min · Pairs

Role-Play: Phishing Defense Scenarios

Pairs draw phishing email examples and act out responses: one sends the lure, the other identifies red flags and reports it. Switch roles, then debrief safe habits like verifying senders. Class votes on best defenses.

Analyze the risks associated with public Wi-Fi networks.

Facilitation Tip

In Phishing Defense Scenarios, give students actual phishing examples from email archives so they practice spotting real-world tricks.

What to look for

Display a list of password examples (e.g., 'password123', 'MyDogSpot!', 'QwertY789'). Ask students to identify which passwords are weak and explain in one sentence why, referencing criteria like length, complexity, and predictability.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 03

• Role Play
• 35 min · Small Groups

Hunt Game: Update Vulnerability Research

In small groups, students use safe search tools to find recent vulnerabilities patched by updates. They check school device update status, justify patching urgency, and create posters warning of risks.

Justify the importance of regular software and operating system updates.

Facilitation Tip

During Update Vulnerability Research, assign each pair a CVE database entry so they connect a specific flaw to a patch.

What to look for

Pose the question: 'Imagine you are traveling and need to check your email at an airport. What are the biggest risks of using the public Wi-Fi, and what steps can you take to minimize them?' Facilitate a class discussion, guiding students to mention risks like data sniffing and suggest solutions like VPNs.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 04

• Role Play
• 25 min · Pairs

Debate Pairs: Public Wi-Fi Risks

Pairs prepare arguments for and against using public Wi-Fi for tasks like banking. They present evidence on interception risks, propose VPN solutions, and vote on safest practices after whole-class discussion.

Develop a personal cybersecurity checklist for online safety.

Facilitation Tip

In Debate Pairs, require students to cite at least one source per argument to move beyond gut feelings.

What to look for

Provide students with a scenario: 'You receive an email asking you to click a link to verify your account details immediately.' Ask them to write two sentences explaining why this might be a phishing attempt and one action they should take instead.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

A few notes on teaching this unit

Effective teaching avoids assuming students know why updates matter beyond 'it’s annoying.' Start with a quick demonstration of a real exploit, like a ransomware screen capture, to show the cost of inaction. Avoid lecturing about multi-factor authentication—instead, have students enable it on their own devices and troubleshoot the steps together. Research shows hands-on experience with real risks shifts behavior more than warnings alone.

Successful learning looks like students confidently explaining why a password is weak, pausing before clicking suspicious links, and updating devices without reminders. They should also back up claims with evidence from the activities, not just opinions.

---

Watch Out for These Misconceptions

• During Audit Station, watch for students who assume antivirus software alone fully protects devices from all cyber threats.

  Use the Device Security Checklists to guide students through testing multiple defenses: scan for malware, review password strength, and inspect update status. When they find gaps, ask them to add a note explaining why each layer matters.

• During Debate Pairs, watch for students who believe public Wi-Fi is secure if it requires a password to join.

  During the debate, provide a Wi-Fi interception simulation tool (like Wireshark) to show how data travels unencrypted even on password-protected networks. Have students revise their arguments based on the evidence they collect.

• During Update Vulnerability Research, watch for students who think software updates mainly add new features and can be skipped if the device works fine.

  Assign each pair a CVE database entry tied to a real exploit. Ask them to trace how skipping an update led to a breach, then present their findings to the class using the research hunt materials.

---

Methods used in this brief

• Role Play