Technologies · Year 9

Active learning ideas

Common Cyber Threats and Safe Practices

Active learning works for this topic because cybersecurity threats rely on human behavior as much as technology. By simulating real-world scenarios, students experience the pressure and uncertainty of actual threats, making abstract risks tangible and memorable.

• ACARA Content Descriptions
• AC9DT10K02
• AC9DT10K03

• 25–45 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Simulation Game
• 30 min · Pairs

Simulation Game: Spot the Phishing

Provide printed or digital sample emails, half phishing with red flags like urgent language or fake links. In pairs, students flag threats, note clues, and propose blocks. Follow with whole-class share-out of common tactics.

Analyze why people are often targeted in cyber attacks.

Facilitation Tip

In Organizational Defense Plan, provide a rubric upfront so groups know exactly how to balance technical controls with user education.

What to look for

Pose the question: 'Why are individuals, not just large companies, frequent targets for cyber criminals?' Facilitate a class discussion where students share their analysis of motivations like financial gain, identity theft, or spreading misinformation. Ask students to provide specific examples of how curiosity or trust can be exploited.

• Apply
• Analyze
• Evaluate
• Create
• Social Awareness
• Decision-Making

Activity 02

• Case Study Analysis
• 40 min · Small Groups

Role-Play: Scam Defense Scenarios

Assign small groups one scam type, such as fake tech support calls. One acts as scammer, others as victims practicing responses like verifying sources. Rotate roles and debrief effective strategies.

Design strategies to protect personal information online.

What to look for

Present students with three short scenarios describing online interactions. For each scenario, ask students to identify the potential cyber threat (e.g., phishing, scam) and explain one specific action they would take to protect themselves or their information. Collect responses to gauge understanding of threat identification and basic defense.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 03

• Case Study Analysis
• 25 min · Pairs

Workshop: Password and MFA Challenge

Pairs generate passwords, test strength with free online tools, then set up mock MFA on accounts. Discuss trade-offs between memorability and security. Class votes on strongest examples.

Evaluate the importance of strong passwords and multi-factor authentication.

What to look for

On an exit ticket, ask students to define 'phishing' in their own words and list two strategies they will implement this week to protect their personal information online. Review responses to assess comprehension of key threats and personal defense planning.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 04

• Case Study Analysis
• 45 min · Small Groups

Design Lab: Organizational Defense Plan

Small groups research a threat like ransomware, then create a one-page defense plan with steps for staff training and tools. Present to class for peer feedback on completeness.

Analyze why people are often targeted in cyber attacks.

What to look for

Pose the question: 'Why are individuals, not just large companies, frequent targets for cyber criminals?' Facilitate a class discussion where students share their analysis of motivations like financial gain, identity theft, or spreading misinformation. Ask students to provide specific examples of how curiosity or trust can be exploited.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

A few notes on teaching this unit

Teachers approach this topic by emphasizing that technology alone cannot stop social engineering. Start with empathy by asking students to recall a time they trusted the wrong source online. Avoid over-relying on scare tactics; instead, focus on iterative testing and refinement of defenses. Research shows that students retain strategies better when they fail safely during simulations and then redesign their approach.

Successful learning looks like students confidently identifying phishing cues, designing layered defenses, and explaining why single solutions fail. They should articulate trade-offs between convenience and security and revise strategies based on feedback.

---

Watch Out for These Misconceptions

• During Spot the Phishing, watch for students who assume antivirus software catches everything.

  Use the simulation’s scoreboard to show how many phishing emails bypass antivirus, then immediately review case studies where user clicks caused breaches despite up-to-date protection.

• During Scam Defense Scenarios, listen for students who claim cyber attacks only target big companies.

  Have role-players share personal stories of scams they’ve encountered or heard about, then map these incidents to financial or reputational damage to highlight individual risks.

• During Password and MFA Challenge, watch for students who believe long passwords alone are enough.

  After testing passwords in pairs, demonstrate how keyloggers capture long passwords and how reused passwords allow credential stuffing attacks, then shift to MFA as the required next step.

---

Methods used in this brief

• Simulation Game
• Case Study Analysis