Common Cyber Threats

Active learning breaks down abstract cyber threats into tangible, hands-on experiences where students can see risks in action. By moving through stations, creating phishing emails, and role-playing attacks, they build both technical understanding and practical defenses.

• Grade 9
• Computer Science
• 4 activities
• 30 min–45 min

Learning Objectives

1. Compare and contrast the mechanisms of viruses, worms, and ransomware.
2. Analyze the common elements and deceptive tactics used in phishing attempts.
3. Predict the potential consequences of a successful denial-of-service attack on a specific online service.
4. Evaluate the ethical implications of creating or distributing malware.
5. Identify preventative measures individuals and organizations can take against common cyber threats.

Stations Rotation

⏱ 45 min·Small Groups

Stations Rotation: Threat Identification Stations

Prepare four stations with samples: malware descriptions to sort, phishing emails to flag, DoS impact videos to note, and ransomware case studies to discuss. Groups rotate every 10 minutes, recording key traits and defenses at each. Debrief as a class to compare findings.

Prepare & details

Compare and contrast different types of malware (e.g., viruses, worms, ransomware).

Facilitation Tip: During Threat Identification Stations, circulate with a checklist to note which threats stump students and revisit those during the Malware Matching Game.

Setup: Tables/desks arranged in 4-6 distinct stations around room

Materials: Station instruction cards, Different materials per station, Rotation timer

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

Case Study Analysis

⏱ 30 min·Pairs

Phishing Email Creation Challenge: Pairs

Pairs craft realistic phishing emails using templates, then swap with another pair to identify scam indicators like poor grammar or fake URLs. Discuss effective defenses such as two-factor authentication. Vote on the most convincing scam.

Prepare & details

Analyze the characteristics of a phishing attempt to identify potential scams.

Facilitation Tip: For the Phishing Email Creation Challenge, provide a rubric upfront so pairs focus on realistic traits like urgency and sender spoofing, not just dramatic mistakes.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 35 min·Whole Class

Malware Matching Game: Whole Class

Display cards with malware definitions, examples, and effects. Students match them in a timed relay race across the room. Review matches and extend to real-world prevention strategies like updates and antivirus software.

Prepare & details

Predict the potential impact of a successful cyberattack on an individual or organization.

Facilitation Tip: In the Cyber Impact Role-Play, assign roles based on student interests to keep engagement high, but prompt each group to document their scenario’s consequences in writing.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 40 min·Small Groups

Cyber Impact Role-Play: Small Groups

Assign roles like individual user, small business owner, or school admin facing a threat. Groups predict and act out consequences, then brainstorm mitigation plans. Share strategies in a gallery walk.

Prepare & details

Compare and contrast different types of malware (e.g., viruses, worms, ransomware).

Facilitation Tip: During the Malware Matching Game, assign a timekeeper to keep the whole-class discussion moving, but pause after each match to ask students to justify their choices aloud.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Teaching This Topic

Teach cyber threats by connecting them to students’ lived experiences, such as fake login prompts they’ve seen or game server outages they’ve experienced. Avoid overwhelming them with jargon; instead, use comparisons like ‘a virus is like a flu that needs a host file to spread, while a worm is like a cold that jumps from person to person on its own.’ Research shows that active, collaborative tasks improve retention of technical concepts, so prioritize discussion and creation over lectures.

What to Expect

By the end of these activities, students should confidently identify malware types by their behaviors, detect phishing cues in varied formats, and articulate the real-world consequences of cyberattacks on individuals and organizations.

Watch Out for These Misconceptions

Common Misconception

During Threat Identification Stations, watch for students grouping all malware together as ‘bad files’ that only spread through downloads.

What to Teach Instead

Use the Malware Matching Game to have students physically sort cards by behaviors: viruses need hosts, worms spread alone, and ransomware encrypts data. Ask them to debate why a ‘fake update’ link might be a worm, not a virus, using the station examples as evidence.

Common Misconception

During the Phishing Email Creation Challenge, watch for students assuming phishing only happens in obvious emails with misspellings.

What to Teach Instead

Require pairs to include subtle phishing traits in their creations, like a spoofed sender address or a ‘limited-time’ offer. After sharing, facilitate a class vote on which emails felt most realistic, using the station samples as counterexamples.

Common Misconception

During Cyber Impact Role-Play, watch for students dismissing attacks as only affecting big companies.

What to Teach Instead

Assign groups to role-play impacts on a student, a small business owner, and a gamer, then have them present their scenarios side by side. Use this to highlight how phishing or ransomware disrupts daily life, not just corporate networks.

Assessment Ideas

Quick Check

After Malware Matching Game, present three short scenarios (e.g., ‘A pop-up claims your files are locked until you pay; what is this?’). Ask students to identify the threat and explain their reasoning using terms from the matching activity.

Exit Ticket

During Threat Identification Stations, hand out a template asking students to name one malware type and describe its spread. Then, ask them to list two actions to avoid phishing, referencing the phishing samples they analyzed.

Discussion Prompt

After Cyber Impact Role-Play, pose the scenario: ‘A popular game’s login servers crash due to a DoS attack. What are three consequences for players and the company?’ Use the group presentations to fuel a class discussion on economic, social, and reputational impacts.

Extensions & Scaffolding

• Challenge early finishers to design a phishing email that targets a specific audience (e.g., gamers, students) and test its realism in a peer review station.
• Scaffolding for struggling students: Provide a partially filled phishing email template with highlighted spoofed elements for them to complete and present in pairs.
• Deeper exploration: Assign a research task to find real-world examples of ransomware attacks on schools or hospitals, and analyze their impact using the role-play structure.

Key Vocabulary

Malware	Short for malicious software, this is any software intentionally designed to cause damage to a computer, server, client, or computer network.
Phishing	A cybercrime where attackers attempt to trick victims into revealing sensitive information, such as usernames, passwords, and credit card details, often through deceptive emails or websites.
Ransomware	A type of malware that encrypts a victim's files, making them inaccessible until a ransom is paid to the attacker for the decryption key.
Denial-of-Service (DoS) Attack	An attack designed to overwhelm a system, server, or network with traffic, making it unavailable to its intended users.
Virus	A type of malware that attaches itself to legitimate files or programs and replicates when those files are executed, spreading to other systems.
Worm	A standalone type of malware that replicates itself to spread to other computers, often exploiting network vulnerabilities without requiring user interaction.