Computing · Year 7

Active learning ideas

Strong Passwords and Authentication

Active learning turns abstract cybersecurity concepts into concrete skills students can test and refine. When students craft, crack, and debate passwords in real time, they move beyond memorisation to internalise why complexity and randomness matter.

• National Curriculum Attainment Targets
• KS3: Computing - Online Safety
• KS3: Computing - Cybersecurity

• 25–45 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Collaborative Problem-Solving
• 30 min · Pairs

Pairs Challenge: Create and Crack Passwords

Pairs generate three passwords: one weak, one medium, one strong, using printed checklists for criteria like length and character mix. They swap with another pair to guess or rate them based on common attacks. Class shares results and refines rules together.

Design a robust password strategy that balances security and memorability.

Facilitation Tip

During the Pairs Challenge, set a 5-minute timer to pressure-test passwords, then have pairs switch roles to simulate attacker-defender dynamics.

What to look for

Present students with five example passwords. Ask them to rate each password's strength on a scale of 1-5 and provide a one-sentence justification for their rating, focusing on length, character types, and predictability.

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Activity 02

• Collaborative Problem-Solving
• 45 min · Small Groups

Small Groups: Authentication Method Stations

Set up stations for password entry sim, 2FA app demo, biometric scan video, and security questions quiz. Groups rotate every 7 minutes, noting strengths, weaknesses, and real-world uses on worksheets. Debrief with group presentations.

Compare different multi-factor authentication methods for their strengths and weaknesses.

Facilitation Tip

In Authentication Method Stations, assign a 2-minute rotation so groups rotate every station, keeping energy high and preventing over-explanation.

What to look for

Pose the question: 'Imagine you have five different online accounts. What are the pros and cons of using the exact same password for all of them versus using a different password for each?' Facilitate a class discussion where students share their reasoning.

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Activity 03

• Collaborative Problem-Solving
• 35 min · Whole Class

Whole Class: Password Strategy Debate

Divide class into teams to argue positions on key questions, such as unique passwords versus reuse or regular changes versus lifetime use. Teams prepare evidence from prior lessons, debate in rounds, then vote with justifications.

Justify the importance of regular password changes and unique passwords for different accounts.

Facilitation Tip

For the Password Strategy Debate, require students to cite at least one peer’s password example as evidence in their arguments to build listening and citation skills.

What to look for

Ask students to write down one strong password or passphrase they have created (without revealing it to anyone) and then explain in two sentences why it is considered strong according to the principles learned in class.

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

Activity 04

• Collaborative Problem-Solving
• 25 min · Individual

Individual: Personal Security Plan

Students design a poster outlining their password strategy, including passphrase examples, MFA choices for key accounts, and a change schedule. They self-assess against rubrics and share one tip with the class.

Design a robust password strategy that balances security and memorability.

Facilitation Tip

In the Personal Security Plan, provide sentence stems for reflection prompts to scaffold metacognition for students who need structure.

What to look for

Present students with five example passwords. Ask them to rate each password's strength on a scale of 1-5 and provide a one-sentence justification for their rating, focusing on length, character types, and predictability.

• Apply
• Analyze
• Evaluate
• Create
• Relationship Skills
• Decision-Making
• Self-Management

A few notes on teaching this unit

Teaching cybersecurity works best when students experience vulnerability firsthand. Avoid lecturing about password strength; instead, let them create weak options and feel the frustration of cracking attempts. Research shows hands-on simulations build retention more than theoretical warnings. Keep language concrete—avoid jargon like entropy—and use analogies students already know, such as comparing passwords to house keys that must fit multiple locks uniquely.

By the end of these activities, students will confidently build passwords meeting length and complexity rules, compare authentication methods based on security and usability, and justify their choices with evidence. Look for students articulating trade-offs and adjusting their strategies after peer feedback.

---

Watch Out for These Misconceptions

• During Pairs Challenge: Watch for students who create passwords using pet names or birthdays, believing their personal connection makes them secure.

  Prompt pairs to role-play as hackers using social media clues to guess each other’s passwords within 30 seconds, then ask them to redesign using random words or symbols. The frustration of being cracked quickly shifts their understanding of memorability versus security.

• During Authentication Method Stations: Watch for students justifying password reuse because one strong password feels sufficient for all accounts.

  Guide groups to simulate a chain reaction: if one account is breached, map which other accounts become vulnerable. Use sticky notes to visually link accounts, then redesign with unique passwords for each to reinforce the principle of compartmentalisation.

• During Password Strategy Debate: Watch for students dismissing MFA as unnecessary, claiming it adds too much time or hassle.

  Have students trial MFA setups using their own phones and a sample account, timing the process. Then, run a live demo of an account takeover using only a leaked password versus one protected by MFA. The stark contrast in outcomes makes the case for MFA’s efficiency and necessity.

---

Methods used in this brief

• Collaborative Problem-Solving