Computer Science · Grade 10 · Networks and the Internet · Term 2

Cyber Threats and Vulnerabilities

Identify common cyber threats (e.g., malware, phishing) and understand system vulnerabilities.

• Ontario Curriculum Expectations
• CS.HS.S.1
• CS.HS.S.2

About This Topic

Cyber threats and vulnerabilities anchor the Networks and the Internet unit in Ontario's Grade 10 Computer Science curriculum. Students identify threats such as malware, phishing, ransomware, and DDoS attacks, while exploring vulnerabilities like weak passwords, outdated software, and social engineering. They differentiate attack vectors, examine human factors that amplify risks, and predict consequences for individuals, schools, and organizations, aligning with standards CS.HS.S.1 and CS.HS.S.2.

This content builds critical thinking by linking technical flaws to behavioral patterns, preparing students for real-world digital safety. Case studies of Canadian incidents, like phishing scams targeting public services or ransomware hitting hospitals, illustrate evolving threats and underscore ethical responsibilities in cybersecurity.

Active learning excels with this topic because interactive simulations turn passive knowledge into practical skills. When students engage in phishing detection games or vulnerability audits on mock systems, they experience decision-making under pressure, collaborate on defenses, and internalize prevention strategies through trial and reflection.

Key Questions

1. Differentiate between various types of cyber threats and their attack vectors.
2. Analyze how human factors contribute to cybersecurity vulnerabilities.
3. Predict the potential impact of a successful cyberattack on individuals and organizations.

Learning Objectives

• Classify common cyber threats such as malware, phishing, and ransomware based on their attack vectors and intended outcomes.
• Analyze how human behaviors, including weak password practices and susceptibility to social engineering, create system vulnerabilities.
• Evaluate the potential impact of a successful cyberattack on critical infrastructure, such as a hospital's patient data system or a public utility's control network.
• Compare and contrast the defensive strategies required to mitigate different types of cyber threats.

Before You Start

Basic Computer Hardware and Software

Why: Students need a foundational understanding of how computers operate and the roles of different software components to grasp how they can be compromised.

Introduction to Networks

Why: Understanding basic network concepts like data transmission and connectivity is essential before exploring how these networks can be attacked.

Key Vocabulary

Malware	Malicious software designed to disrupt, damage, or gain unauthorized access to computer systems. Examples include viruses, worms, and spyware.
Phishing	A cyberattack where attackers impersonate trustworthy entities to trick individuals into revealing sensitive information, such as passwords or credit card details.
Vulnerability	A weakness in a system, network, or application that can be exploited by a threat actor to compromise security.
Attack Vector	The method or path through which a cyber attacker gains unauthorized access to a computer or network to deliver a payload or malicious outcome.
Social Engineering	The psychological manipulation of people into performing actions or divulging confidential information, often used as a precursor to a cyberattack.

Watch Out for These Misconceptions

Common Misconception

Antivirus software blocks every cyber threat.

What to Teach Instead

No tool catches all attacks; layered defenses are essential. Hands-on trials with mock malware infections show evasion tactics, while group defenses highlight the need for updates and user training.

Common Misconception

Phishing emails always have obvious spelling errors.

What to Teach Instead

Advanced phishing mimics trusted sources perfectly. Practice with peer-created emails in pairs builds pattern recognition, as students debate subtle cues during class shares.

Common Misconception

Only experts face serious cyber vulnerabilities.

What to Teach Instead

Every user contributes through habits like password reuse. Role-plays expose personal risks, fostering empathy and collective strategies in discussions.

Active Learning Ideas

Phishing Identification Relay: Email Sort

Provide 20 sample emails printed or digital. Pairs sort them into phishing or legitimate piles within 10 minutes, noting red flags like urgent language or suspicious links. Debrief as a class to vote on borderline cases and share strategies.

35 min·Pairs

Vulnerability Audit Stations: System Scan

Set up stations with checklists for passwords, updates, and access controls. Small groups rotate, auditing sample devices or policies, then propose fixes. Groups present one key finding to the class.

45 min·Small Groups

Threat Impact Simulation: Role-Play Attack

Assign roles: attackers, defenders, victims. Small groups plan a phishing or malware scenario, execute it safely, then switch to mitigate. Reflect on impacts via shared digital board.

50 min·Small Groups

Cyber Threat Mind Map: Collaborative Build

In small groups, students start with a central node for cyber threats and branch to types, vectors, vulnerabilities. Add examples and impacts using digital tools like Jamboard. Merge maps class-wide.

30 min·Small Groups

Real-World Connections

• Cybersecurity analysts at Canadian banks like RBC or TD analyze threat intelligence feeds to identify emerging phishing campaigns targeting financial customers, developing new detection rules for email filters.
• IT security teams in Ontario hospitals, such as those within Toronto General Hospital, must constantly patch software vulnerabilities and train staff to recognize phishing attempts to protect sensitive patient health information from ransomware attacks.
• The Canadian Centre for Cyber Security provides advisories to businesses and individuals on how to defend against common threats like ransomware, which has impacted numerous Canadian organizations, including municipalities and educational institutions.

Assessment Ideas

Quick Check

Present students with short scenarios describing a potential cyber incident. Ask them to identify the primary cyber threat involved (e.g., phishing, malware) and one specific vulnerability that allowed the incident to occur. For example: 'An employee clicks a link in an email and their computer starts acting strangely. What threat and vulnerability are most likely?'

Discussion Prompt

Facilitate a class discussion using the prompt: 'Imagine our school's network is hit by a ransomware attack. What are three immediate consequences for students and teachers, and what steps should the IT department take first?' Encourage students to consider data access, learning disruption, and communication.

Exit Ticket

Provide students with a list of common cyber threats and vulnerabilities. Ask them to choose one threat and explain in 2-3 sentences how a specific vulnerability makes that threat more effective. For instance: 'Explain how weak passwords contribute to the success of brute-force attacks.'

Frequently Asked Questions

How do human factors contribute to cyber vulnerabilities?

Human errors like clicking unknown links or sharing passwords enable 95% of breaches. Teach this through relatable scenarios: students analyze real phishing examples, identifying emotional triggers like fear or greed. Group reflections connect behaviors to system weaknesses, emphasizing training over tech alone. (62 words)

What are common cyber threats for grade 10 students?

Key threats include phishing, malware, ransomware, and social engineering. Phishing tricks users into revealing data; malware infects devices; ransomware locks files for payment. Use Ontario-specific examples like attacks on schools to show relevance. Students differentiate via threat matrices, predicting personal impacts like data loss or identity theft. (68 words)

How can active learning help students understand cyber threats?

Active methods like simulations and role-plays make threats tangible. Students crafting phishing emails or defending networks in teams experience vulnerabilities firsthand, improving retention by 75% per studies. Peer teaching during debriefs reinforces analysis, while ethical discussions build habits. This beats lectures by engaging multiple senses and promoting application. (72 words)

What is the potential impact of cyberattacks in Canada?

Attacks disrupt services, steal data, and cost billions: think hospital ransomware delaying care or election interference attempts. Individuals face identity theft; organizations lose trust. Students predict outcomes via case studies, graphing economic and social ripple effects. This links to curriculum goals, urging proactive measures like multi-factor authentication. (70 words)