Computer Science · Grade 11

Active learning ideas

Ethical Hacking and Penetration Testing

Active learning works because ethical hacking requires hands-on practice to grasp abstract security concepts. Students retain methodologies better when they simulate real-world scenarios, making this topic ideal for labs, debates, and role-playing exercises that mirror professional environments.

• Ontario Curriculum Expectations
• CS.HS.S.3
• CS.HS.S.6

• 40–60 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 60 min · Small Groups

Lab Simulation: Penetration Testing Stages

Provide virtual machines with Metasploitable. Students follow phases: reconnaissance using Nmap, vulnerability scanning with OpenVAS, simulated access via provided scripts, then report findings. Debrief as a class on ethical reporting. Rotate roles within groups.

Differentiate between ethical hacking and malicious hacking.

Facilitation Tip

During the Lab Simulation, circulate with a checklist to ensure students document each penetration testing stage with timestamps and screenshots for their final reports.

What to look for

Present students with a scenario where a company discovered a vulnerability after a data breach. Ask: 'How could ethical hacking have prevented this breach? What specific steps would an ethical hacker take to find this vulnerability before it was exploited?'

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Role Play
• 45 min · Small Groups

Capture the Flag Challenge: Ethical Exploits

Set up a classroom CTF with puzzles mimicking vulnerabilities, like SQL injection flags in web apps. Teams compete to 'hack' ethically within time limits, logging methods used. Review solutions to highlight best practices.

Analyze the methodologies used in penetration testing to uncover system weaknesses.

Facilitation Tip

For the Capture the Flag Challenge, set a strict time limit to mimic real-world pressure and adjust difficulty based on prior student experience with command-line tools.

What to look for

Provide students with a simplified penetration testing report summary. Ask them to identify two key vulnerabilities and suggest one specific, actionable remediation step for each. For example: 'Vulnerability: Unpatched server. Remediation: Schedule immediate patching and verification.'

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 03

• Role Play
• 40 min · Pairs

Role-Play Debate: Hacker Scenarios

Assign roles as ethical hacker, system owner, or malicious actor. Groups debate responses to a breach scenario, justifying actions with pen testing methodologies. Vote on strongest arguments and connect to real laws.

Justify the importance of ethical hacking in maintaining robust cybersecurity defenses.

Facilitation Tip

In the Role-Play Debate, assign roles in advance and provide scenario cards with clear legal or ethical dilemmas to spark focused discussion.

What to look for

On an index card, have students write down one key difference between ethical hacking and malicious hacking and one reason why penetration testing is crucial for modern organizations.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 04

• Role Play
• 50 min · Pairs

Vulnerability Hunt: Network Audit

Use Wireshark on simulated traffic captures. Students identify weaknesses like unencrypted data, propose fixes, and present audits. Pair with peer review for accuracy.

Differentiate between ethical hacking and malicious hacking.

Facilitation Tip

For the Vulnerability Hunt, divide students into teams and assign distinct network segments to prevent overlap and encourage thorough audits.

What to look for

Present students with a scenario where a company discovered a vulnerability after a data breach. Ask: 'How could ethical hacking have prevented this breach? What specific steps would an ethical hacker take to find this vulnerability before it was exploited?'

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

A few notes on teaching this unit

Teach this topic by starting with the legal framework to ground discussions in real-world consequences. Use scaffolded simulations that build from simple scans to full penetration tests, allowing students to see their progress. Avoid overwhelming students with advanced tools early; instead, focus on methodology first, then introduce complexity. Research shows that students grasp cybersecurity best when they experience both the technical steps and the ethical reasoning behind them.

Successful learning looks like students applying penetration testing stages with precision, distinguishing legal from illegal actions in scenarios, and articulating the importance of ethical reporting. By the end, they should justify their steps with evidence from simulations and audits.

---

Watch Out for These Misconceptions

• During the Role-Play Debate, watch for students conflating ethical hacking with illegal activities because they overlook the requirement for explicit permission. Redirect them to review the scenario cards, which include authorization steps, and have them revise their arguments to include obtaining written consent before testing.

  During the Lab Simulation, address the misconception that penetration testing only detects viruses by having students run vulnerability scans on simulated systems with misconfigured firewalls and weak passwords. After results appear, ask them to categorize findings and explain why malware detection is only one small part of the report.

• During the Capture the Flag Challenge, students may assume anyone can ethically hack after completing a few challenges. Redirect them to the challenge’s end-of-round debrief, where they must justify each exploit using documented methodologies and legal frameworks.

  After the Vulnerability Hunt, clarify that ethical hacking requires structured training by reviewing student audit reports. Highlight missing steps like risk assessment matrices or remediation timelines, then assign a short research task on recognized certification pathways.

---

Methods used in this brief

• Role Play