Computing · Year 11

Active learning ideas

Cybersecurity Threats and Defense

Active learning works for this topic because cybersecurity threats demand hands-on experience to move from abstract concepts to practical understanding. Students need to feel the impact of a phishing email or see an SQL query turn malicious to grasp why multi-layered defenses matter.

• National Curriculum Attainment Targets
• GCSE: Computing - Cyber Security
• GCSE: Computing - Network Security

• 35–50 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 45 min · Pairs

Role-Play: Phishing Scenarios

Pairs take turns as attacker and defender in scripted social engineering scenarios, such as fake emails or phone calls. Switch roles after 5 minutes, then debrief as a class on recognition cues and responses. Extend by having pairs create their own scenarios for others to defend.

Why is the human element often the weakest link in a cybersecurity strategy?

Facilitation Tip

During the Role-Play: Phishing Scenarios activity, assign roles so students experience both the attacker’s tactics and the victim’s decision-making process.

What to look for

Present students with short scenarios describing a potential cyber threat. Ask them to identify the type of threat (e.g., social engineering, SQL injection, DDoS) and briefly explain why. For example: 'An email arrives claiming to be from IT support, asking for your password to fix an urgent issue. What is this, and why is it dangerous?'

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Simulation Game
• 50 min · Small Groups

Simulation Game: SQL Injection Lab

Small groups access a safe online demo site to input malicious code and observe breach effects. Record steps leading to data exposure, then propose fixes like input sanitisation. Share findings in a whole-class gallery walk.

How can a simple SQL injection attack lead to a massive data breach?

Facilitation Tip

In the Simulation: SQL Injection Lab, provide a deliberately vulnerable web form and walk students through crafting simple payloads to observe database responses together.

What to look for

Pose the question: 'Why is the human element often the weakest link in a cybersecurity strategy?' Facilitate a class discussion where students share examples of social engineering and discuss how education and awareness can strengthen this link. Prompt them to consider what makes humans susceptible to these attacks.

• Apply
• Analyze
• Evaluate
• Create
• Social Awareness
• Decision-Making

Activity 03

• Role Play
• 40 min · Small Groups

Strategy Design: DDoS Defense Layers

Small groups outline multi-layered defenses for a DDoS scenario, including firewalls, rate limiting, and backups. Present posters showing decision trees for remote worker policies. Vote on strongest elements class-wide.

How would you design a security policy for a company with remote workers?

Facilitation Tip

For the Strategy Design: DDoS Defense Layers activity, give teams a budget constraint to force prioritization of cost-effective solutions like filtering and redundancy.

What to look for

In small groups, students draft a basic security policy for a fictional company with remote workers. They should include at least three defense strategies. After drafting, groups swap policies and provide feedback using a checklist: Does the policy address social engineering? Are there technical controls mentioned? Is it clear and actionable? Each group signs off on the reviewed policy.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 04

• Role Play
• 35 min · Whole Class

Policy Workshop: Remote Security

Whole class brainstorms a company policy addressing key questions, dividing into committees for sections like training and monitoring. Draft and refine collaboratively using shared digital docs.

Why is the human element often the weakest link in a cybersecurity strategy?

Facilitation Tip

During the Policy Workshop: Remote Security, provide a template with placeholders for policies to scaffold structure, then challenge groups to fill gaps with real-world examples.

What to look for

Present students with short scenarios describing a potential cyber threat. Ask them to identify the type of threat (e.g., social engineering, SQL injection, DDoS) and briefly explain why. For example: 'An email arrives claiming to be from IT support, asking for your password to fix an urgent issue. What is this, and why is it dangerous?'

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

A few notes on teaching this unit

Approach this topic by balancing theory with immersive practice, as research shows students retain cybersecurity concepts better when they apply them in context. Avoid spending too much time on technical jargon without immediate application. Instead, link each activity to a real-world consequence, such as data breaches or service outages, to make the stakes clear. Emphasize that cybersecurity is a system, not a single tool, by consistently asking students to explain how layers connect.

Successful learning looks like students confidently identifying threats, explaining why technical controls alone fail, and designing policies that balance human behavior with technical safeguards. They should articulate how each layer in their defense strategies mitigates specific risks.

---

Watch Out for These Misconceptions

• Antivirus software alone protects against all cyber threats.

  During Role-Play: Phishing Scenarios, pause after each round to debrief how students felt as victims and why technical tools could not stop the attack. Highlight how policy training and user behavior fill gaps that software misses.

• SQL injection requires advanced hacking skills.

  During Simulation: SQL Injection Lab, point to the simple payloads students write on the first attempt. Use the lab’s debug logs to show how minor input errors escalate to full database access.

• DDoS attacks are unstoppable for small organisations.

  During Strategy Design: DDoS Defense Layers, have teams present their layered plans and critique each other’s choices. Focus on how filtering and redundancy shift the attack’s impact from catastrophic to manageable.

---

Methods used in this brief

• Role Play
• Simulation Game