Computer Science · Class 11

Active learning ideas

Cybersecurity Threats: Malware and Phishing

Active learning helps students internalise cybersecurity concepts because these threats are abstract and constantly evolving. When students analyse real phishing emails or simulate infections, they move from passive awareness to tangible skills that protect data in their daily digital lives.

• CBSE Learning Outcomes
• CBSE: Society, Law and Ethics - Cyber Safety - Class 11

• 25–40 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 35 min · Small Groups

Email Audit: Spot Phishing Clues

Provide printed sample emails, some legitimate and some phishing. In small groups, students list red flags like mismatched sender domains, urgent demands, or suspicious attachments. Groups vote on classifications and justify choices to the class.

Explain the different types of malware and how they compromise computer systems.

Facilitation Tip

During Email Audit, give students magnifying glasses to examine each email header line closely, as attackers often hide clues in less obvious fields like 'reply-to' addresses.

What to look for

Provide students with two short scenarios: one describing a typical malware infection and another detailing a phishing attempt. Ask them to write one sentence for each scenario explaining the core threat and one sentence identifying a key indicator that distinguishes it from legitimate activity.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Role Play
• 25 min · Pairs

Flowchart Duel: Virus vs Worm

Pairs draw flowcharts showing virus replication needing user action versus worm self-spreading. They swap charts with another pair for peer review and corrections. Present one key difference to the whole class.

Analyze the characteristics of a phishing attempt to identify potential scams.

Facilitation Tip

During Flowchart Duel, provide students with blank flowcharts and coloured pencils to map each malware type’s behaviour step-by-step, reinforcing sequential thinking.

What to look for

Present a mock phishing email to the class. Ask: 'What are three specific elements in this email that raise suspicion? How could a user verify the legitimacy of the sender or the linked website without clicking on it?' Facilitate a class discussion on their observations and verification methods.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 03

• Role Play
• 40 min · Small Groups

Role-Play Station: Social Engineering

Set up stations for tactics like pretexting or baiting. Small groups act as attacker and defender in 5-minute skits. Observers note defence strategies, then rotate roles and debrief common errors.

Differentiate between various social engineering tactics used by cybercriminals.

Facilitation Tip

During Role-Play Station, set a timer for each scenario to keep energy high, then pause for 30 seconds of silent reflection before switching roles.

What to look for

Display a list of malware types (e.g., Virus, Worm, Trojan, Ransomware) and social engineering tactics (e.g., Phishing, Pretexting, Baiting). Ask students to match each tactic to its primary goal or mechanism. Review answers as a class, clarifying any misconceptions.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 04

• Role Play
• 30 min · Whole Class

Threat Hunt Game: Whole Class Quiz

Project scenarios on malware or phishing. Students buzz in with buzzers or hands to identify threats and suggest preventions. Tally scores and discuss wrong answers as a class.

Explain the different types of malware and how they compromise computer systems.

Facilitation Tip

During Threat Hunt Game, assign each team a different colour sticky note so you can quickly see which groups spotted threats fastest during the class review.

What to look for

Provide students with two short scenarios: one describing a typical malware infection and another detailing a phishing attempt. Ask them to write one sentence for each scenario explaining the core threat and one sentence identifying a key indicator that distinguishes it from legitimate activity.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

A few notes on teaching this unit

Teachers should avoid overwhelming students with technical jargon first. Start with relatable examples like school Wi-Fi outages or classmate accounts being hacked, then layer technical terms onto familiar experiences. Research shows that connecting cybersecurity to students’ lived digital habits makes lessons stick. Emphasise that technology alone cannot prevent breaches, so human vigilance is central.

Successful learning is visible when students confidently identify phishing red flags, distinguish viruses from worms through clear examples, and explain why social engineering tricks succeed even when technology defences fail.

---

Watch Out for These Misconceptions

• During Flowchart Duel, watch for students grouping all malware under 'Virus' without distinguishing replication methods.

  Provide a sorting mat with two columns labelled 'Needs Host' and 'Self-Spreading' and have pairs place example cards like 'Trojan' and 'Worm' under the correct column before creating flowcharts.

• During Role-Play Station, watch for students assuming phishing only involves emails.

  Give each pair three scenario cards: one email, one SMS, and one voice call, and require them to act out each version before discussing how tone and urgency vary across channels.

• During Threat Hunt Game, watch for students believing antivirus software catches every threat.

  Include two fake 'AV scan' icons in your quiz: one showing a green tick and another showing a 'zero-day threat bypassed' message, then discuss why human checks matter.

---

Methods used in this brief

• Role Play