Computer Science · Grade 12

Active learning ideas

Cloud Security and Privacy

Active learning works for cloud security because students need to experience the gaps in shared responsibility firsthand. When they simulate breach scenarios or negotiate compliance roles, the abstract division of duties between provider and user becomes concrete and memorable.

• Ontario Curriculum Expectations
• CS.N.10
• CS.S.4
• CS.SE.1

• 40–60 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Philosophical Chairs
• 50 min · Small Groups

Case Study Dissection: Cloud Breaches

Assign groups real incidents like the Capital One AWS breach. Students map failures to the shared responsibility model and propose fixes. Groups present key takeaways to the class for discussion.

What are the risks of relying on a single cloud provider for critical infrastructure?

Facilitation Tip

During the Case Study Dissection, assign specific roles (e.g., cloud provider, customer, regulator) so students see how one breach triggers multiple responsibilities.

What to look for

Pose this question to small groups: 'Imagine your school is considering moving student records to a cloud service. What are the top three security risks you would identify, and how would the shared responsibility model apply to mitigating them?' Facilitate a class share-out of key concerns.

• Analyze
• Evaluate
• Self-Awareness
• Social Awareness

Activity 02

• Formal Debate
• 40 min · Pairs

Formal Debate: Single Provider Dependency

Pairs prepare arguments for and against using one cloud provider for government systems. Hold a whole-class debate with structured rebuttals. Vote and debrief on risk trade-offs.

Explain the shared responsibility model in cloud security.

Facilitation Tip

For the Debate: Single Provider Dependency, provide a cost-benefit handout with real outage timelines to ground arguments in data rather than opinion.

What to look for

Provide students with a scenario: 'A cloud service provider announces a data breach affecting customer data stored in their Canadian data centers.' Ask students to write down two immediate actions a user of that service should take, referencing the shared responsibility model and potential privacy implications.

• Analyze
• Evaluate
• Create
• Self-Management
• Decision-Making

Activity 03

• Philosophical Chairs
• 45 min · Individual

Privacy Audit Simulation

Individuals review a mock cloud app storing student data. In small groups, conduct a PIPEDA compliance check using checklists. Share audit reports and recommend privacy enhancements.

Assess the privacy implications of storing personal data in the cloud.

Facilitation Tip

In the Privacy Audit Simulation, give teams identical datasets but different cloud configurations so they directly compare exposure risks.

What to look for

Students create a brief presentation (3-5 slides) comparing the security features of two major cloud providers (e.g., AWS, Azure, Google Cloud). Peers assess presentations based on accuracy of information regarding encryption, access controls, and compliance certifications, providing one specific area for improvement.

• Analyze
• Evaluate
• Self-Awareness
• Social Awareness

Activity 04

• Philosophical Chairs
• 60 min · Small Groups

Threat Modeling Workshop

Whole class uses STRIDE framework on a sample cloud architecture. Break into small groups to identify threats and mitigations. Compile a class risk matrix.

What are the risks of relying on a single cloud provider for critical infrastructure?

Facilitation Tip

During the Threat Modeling Workshop, require students to map data flows first before proposing controls, reinforcing process over quick fixes.

What to look for

Pose this question to small groups: 'Imagine your school is considering moving student records to a cloud service. What are the top three security risks you would identify, and how would the shared responsibility model apply to mitigating them?' Facilitate a class share-out of key concerns.

• Analyze
• Evaluate
• Self-Awareness
• Social Awareness

A few notes on teaching this unit

Teachers should anchor lessons in real incidents and Canadian regulations so concepts feel relevant. Avoid overwhelming students with technical jargon; focus on the shared responsibility model as a framework rather than a checklist. Research shows that role-playing breach aftermaths helps students internalize consequences and ethical obligations faster than lectures alone.

By the end, students should confidently distinguish provider duties from customer duties, articulate privacy risks tied to Canadian law, and design mitigation strategies in multi-cloud environments. Success means they can justify decisions using evidence from case studies and simulations.

---

Watch Out for These Misconceptions

• During Case Study Dissection: Cloud Breaches, watch for students assuming the provider caused the breach because they provided the service.

  Use the case study handout to have students trace each control failure back to the shared responsibility model, labeling which party missed a duty in their analysis.

• During Privacy Audit Simulation, watch for students equating cloud storage with automatic privacy protection.

  Ask teams to compare their audit findings with PIPEDA requirements, highlighting where configurations failed consent or breach notification clauses.

• During Debate: Single Provider Dependency, watch for students believing multiple providers eliminate all risks.

  Have debaters reference the hybrid setup models they explored in the Threat Modeling Workshop to expose synchronization and compliance gaps.

---

Methods used in this brief

• Philosophical Chairs
• Formal Debate