Computing · Year 10

Active learning ideas

Network Security Threats: Social Engineering

Active learning works well for this topic because social engineering relies on human behaviour, not just technical knowledge. Students need to experience manipulation firsthand to recognize vulnerabilities in themselves and others, making simulations and debates more effective than lectures alone.

• National Curriculum Attainment Targets
• GCSE: Computing - Network Security

• 30–50 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 35 min · Pairs

Role-Play: Phishing Attack Simulation

Pairs create phishing emails using templates, then swap and identify red flags like urgent language or suspicious links. Discuss defences such as verifying senders. Debrief as a class on common tactics.

Is the greatest threat to a network's security the software or the human user?

Facilitation Tip

During the phishing simulation, assign each student a role—attacker, victim, or observer—to ensure all perspectives are engaged.

What to look for

Provide students with three short scenarios describing potential cyber threats. Ask them to identify which scenario represents a social engineering attack, name the specific tactic used (e.g., phishing, baiting), and explain why it is a threat.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Role Play
• 45 min · Small Groups

Group Debate: Human vs Software Threats

Divide class into teams to argue if humans or software are bigger risks, using evidence from phishing and pharming examples. Rotate speakers and vote on strongest points. Summarise key insights.

Explain how social engineering tactics manipulate individuals into revealing sensitive information.

Facilitation Tip

For the human vs software debate, require students to cite specific examples from the phishing scenarios or real-world cases to ground their arguments.

What to look for

Pose the question: 'Is the greatest threat to a network's security the software or the human user?' Facilitate a class discussion where students must support their arguments with examples of both technical vulnerabilities and social engineering tactics, referencing specific attacks discussed in class.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 03

• Role Play
• 50 min · Small Groups

Campaign Design: Awareness Posters

Small groups research social engineering scams and design posters with examples, warning signs, and tips. Present to class for feedback and vote on most effective.

Design a public awareness campaign to educate users about common social engineering scams.

Facilitation Tip

When students analyze phishing emails, provide a checklist of red flags to scaffold their scrutiny of technical and emotional cues.

What to look for

Present students with a simulated phishing email. Ask them to identify at least three red flags within the email that indicate it is a scam and explain what action they would take if they received it.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 04

• Role Play
• 30 min · Pairs

Pharming Hunt: Website Analysis

Individuals or pairs scrutinise mock websites for pharming clues like mismatched URLs or poor security badges. Log findings and propose verification steps.

Is the greatest threat to a network's security the software or the human user?

Facilitation Tip

Have students swap posters in the awareness campaign activity and give feedback using a rubric focused on clarity, accuracy, and impact.

What to look for

Provide students with three short scenarios describing potential cyber threats. Ask them to identify which scenario represents a social engineering attack, name the specific tactic used (e.g., phishing, baiting), and explain why it is a threat.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

A few notes on teaching this unit

Teachers should model scepticism and curiosity, showing how to question messages and links without assuming malice. Avoid framing this topic as ‘don’t trust anyone,’ which can create paranoia. Instead, emphasize critical thinking and shared responsibility. Research shows that students learn best when they see how subtle cues—like sender names or time pressures—can override good judgment.

Successful learning looks like students who can identify social engineering tactics in real world contexts, explain why human factors are critical to network security, and design preventive measures. They should move from passive awareness to active discernment and advocacy.

---

Watch Out for These Misconceptions

• During Role-Play: Phishing Attack Simulation, watch for students who believe antivirus software will catch all phishing attempts.

  During Role-Play: Phishing Attack Simulation, use the debrief to contrast the simulation outcomes with what antivirus software can and cannot detect. Have students revisit their simulated emails to identify features that bypass automated tools, like urgency or personalization.

• During Group Debate: Human vs Software Threats, watch for students who assume only non-technical people fall for scams.

  During Group Debate: Human vs Software Threats, structure the debate so each group defends a scenario from the phishing simulation. Ask them to share personal or observed mistakes, highlighting how even skilled users can be manipulated under pressure.

• During Campaign Design: Awareness Posters, watch for students who believe social engineering requires face-to-face contact.

  During Campaign Design: Awareness Posters, incorporate examples from email-based attacks like phishing and pharming. Ask students to include digital cues in their posters, such as domain names or suspicious links, to challenge the misconception.

---

Methods used in this brief

• Role Play