Computing · Year 9

Active learning ideas

Introduction to Cybersecurity

Active learning works for cybersecurity because students need to practise spotting real-world tricks, not just hear about them. When students sort real phishing emails or act out attack scenarios, they build the same mental models professionals use to stay safe online.

• National Curriculum Attainment Targets
• KS3: Computing - Cybersecurity
• KS3: Computing - Online Safety

• 30–45 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Four Corners
• 30 min · Pairs

Sorting Task: Phishing Emails

Print 10 sample emails, five phishing and five legitimate. Pairs sort them into categories and note clues like urgent demands or fake sender addresses. Follow with a class share-out on common red flags.

Explain why cybersecurity is a critical concern for individuals and organizations today.

Facilitation Tip

For the Sorting Task, provide printed emails on coloured paper so students physically move and group them rather than just reading on screen.

What to look for

Provide students with two scenarios: one describing a potential malware infection and another describing a phishing attempt. Ask them to write one sentence for each scenario explaining the threat and one sentence describing a protective action they could take.

• Understand
• Analyze
• Evaluate
• Self-Awareness
• Social Awareness

Activity 02

• Four Corners
• 40 min · Small Groups

Matching Game: Cyber Threats

Prepare cards with threat names, descriptions, and examples. Small groups match them, then draw a class mind map linking threats to consequences. Extend by inventing prevention tips for each.

Differentiate between various types of cyber threats, such as malware and phishing.

What to look for

Pose the question: 'Imagine your school's network was hit by ransomware. What are three specific problems this would cause for students and teachers?' Facilitate a class discussion, encouraging students to consider data loss, access to learning resources, and operational disruption.

• Understand
• Analyze
• Evaluate
• Self-Awareness
• Social Awareness

Activity 03

• Four Corners
• 45 min · Small Groups

Role-Play: Attack Scenarios

Assign roles like hacker, employee, and IT support. Groups act out a phishing or malware scenario, then switch to practise responses. Debrief on what worked and real-world fixes.

Analyze the potential consequences of a successful cyberattack on personal data.

What to look for

Show students three examples of online communications: a legitimate email, a fake phishing email, and a social media post containing a suspicious link. Ask them to label each as 'Safe', 'Phishing', or 'Malware Risk' and briefly justify their choice for the unsafe examples.

• Understand
• Analyze
• Evaluate
• Self-Awareness
• Social Awareness

Activity 04

• Case Study Analysis
• 35 min · Pairs

Case Study Analysis: Breach Review

Share a simplified real-world breach summary. Individuals or pairs identify the threat type, causes, and impacts, then propose three safeguards. Present findings to the class.

Explain why cybersecurity is a critical concern for individuals and organizations today.

What to look for

Provide students with two scenarios: one describing a potential malware infection and another describing a phishing attempt. Ask them to write one sentence for each scenario explaining the threat and one sentence describing a protective action they could take.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

A few notes on teaching this unit

Teach this topic by starting with relatable risks—students’ own social media accounts or school login prompts—so they see cybersecurity as personal protection, not abstract policy. Use low-stakes role-plays first to build judgement before moving to technical terms like ‘malware’ or ‘encryption.’ Research shows that behavioural rehearsal changes habits more than lectures alone.

Successful learning looks like students confidently distinguishing phishing from genuine messages and explaining why specific threats matter to individuals and organisations. They should also suggest layered protections, not just rely on one tool or rule.

---

Watch Out for These Misconceptions

• During Sorting Task: Phishing Emails, watch for students assuming phishing emails always contain obvious spelling mistakes.

  During Sorting Task: Phishing Emails, circulate and point out subtle cues like mismatched sender domains or disguised URLs, then ask students to revise their groupings based on these clues.

• During Matching Game: Cyber Threats, watch for students believing antivirus software prevents all malware.

  During Matching Game: Cyber Threats, ask students to match ‘human error’ cards with behavioural defences like ‘verify before you click,’ linking threats to actions beyond software.

• During Role-Play: Attack Scenarios, watch for students assuming phishing attacks are easy to detect.

  During Role-Play: Attack Scenarios, use the debrief to highlight how pressure tactics (urgent deadlines) or mimicry (fake teacher emails) trick people, reinforcing that training reduces but does not eliminate risk.

---

Methods used in this brief

• Four Corners
• Case Study Analysis