Introduction to Cyber Security

Active learning works for cyber security because students must experience vulnerabilities firsthand to understand protective measures. Simulations and challenges help them internalize abstract concepts like the CIA triad, making risks and defenses tangible rather than theoretical.

• JC 1
• Computing
• 4 activities
• 25 min–45 min

Learning Objectives

1. Explain the principles of confidentiality, integrity, and availability (CIA triad) and their significance in protecting digital information.
2. Differentiate between common cyber threats including malware, phishing, and denial-of-service attacks, citing specific examples of each.
3. Analyze the vulnerabilities associated with weak password practices and justify the implementation of multi-factor authentication.
4. Evaluate the effectiveness of basic security measures in mitigating identified cyber threats.

Simulation Game

⏱ 30 min·Pairs

Simulation Game: Phishing Detection Relay

Distribute printed sample emails with phishing cues like urgent requests or fake links. Pairs scan for red flags in 5 minutes, then relay findings to the next pair for verification. Conclude with whole-class vote on safest responses.

Prepare & details

Explain the importance of confidentiality, integrity, and availability (CIA triad) in cybersecurity.

Facilitation Tip: During the Phishing Detection Relay, stand back to observe students' hesitation or confidence to gauge their readiness for deeper discussions.

Setup: Flexible space for group stations

Materials: Role cards with goals/resources, Game currency or tokens, Round tracker

• Apply
• Analyze
• Evaluate
• Create
• Social Awareness
• Decision-Making

Timeline Challenge

⏱ 25 min·Small Groups

Timeline Challenge: Password Cracking Contest

Small groups generate passwords meeting criteria, then use a safe online tool to test crack time. Iterate designs based on feedback, comparing length, symbols, and uniqueness. Share top strategies in a class showcase.

Prepare & details

Differentiate between common cyber threats like malware, phishing, and denial-of-service attacks.

Facilitation Tip: For the Password Cracking Contest, circulate with a timer visible so students pace themselves and reflect on the effort required to crack passwords.

Setup: Long wall or floor space for timeline construction

Materials: Event cards with dates and descriptions, Timeline base (tape or long paper), Connection arrows/string, Debate prompt cards

• Remember
• Understand
• Analyze
• Self-Management
• Relationship Skills

Escape Room

⏱ 40 min·Small Groups

Role-Play: CIA Triad Scenarios

Assign groups one CIA element as defenders of a mock company network. Present threat cards like phishing or DoS; groups respond with countermeasures. Rotate roles and peer-review effectiveness.

Prepare & details

Justify the need for strong passwords and multi-factor authentication.

Facilitation Tip: In the CIA Triad Role-Play, assign roles purposely to ensure quieter students contribute while dominant ones balance perspectives.

Setup: Group tables with puzzle envelopes, optional locked boxes

Materials: Puzzle packets (4-6 per group), Lock boxes or code sheets, Timer (projected), Hint cards

• Remember
• Apply
• Analyze
• Relationship Skills
• Self-Management

Stations Rotation

⏱ 45 min·Small Groups

Stations Rotation: Threat Mapping Boards

Set up boards for malware, phishing, and DoS with sticky notes for vulnerabilities and fixes. Groups rotate every 10 minutes, adding examples from news clips. Synthesize into a class threat matrix.

Prepare & details

Explain the importance of confidentiality, integrity, and availability (CIA triad) in cybersecurity.

Facilitation Tip: At the Threat Mapping Boards, circulate with guiding questions to push groups beyond obvious threats to consider secondary or cascading effects.

Setup: Tables/desks arranged in 4-6 distinct stations around room

Materials: Station instruction cards, Different materials per station, Rotation timer

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

Teaching This Topic

Start by grounding concepts in familiar contexts, like school Wi-Fi or library computers, before introducing jargon. Avoid overwhelming students with technical details; instead, focus on how threats impact their daily digital lives. Research shows hands-on simulations build lasting understanding of abstract security principles.

What to Expect

Successful learning looks like students confidently explaining threats and defenses using the CIA triad in discussions and activities. They should transfer classroom scenarios to real-world contexts, such as school Wi-Fi or banking apps, and justify their security choices.

Watch Out for These Misconceptions

Common Misconception

During the Phishing Detection Relay, watch for students assuming antivirus software will block all phishing attempts.

What to Teach Instead

Use the relay to demonstrate how phishing bypasses technical defenses, then facilitate a debrief where students identify why user vigilance is critical alongside antivirus.

Common Misconception

During the CIA Triad Role-Play, watch for students assuming cyber attacks only affect large companies like banks or hospitals.

What to Teach Instead

In the role-play, assign scenarios involving personal devices or school accounts to show that individuals face daily risks, then have students share real-life examples they’ve encountered.

Common Misconception

During the Password Cracking Contest, watch for students assuming long passwords are always secure regardless of uniqueness.

What to Teach Instead

Use the cracking challenge to reveal how reused passwords undermine security, then guide students to redesign passwords with multi-factor authentication in mind during a collaborative redesign activity.

Assessment Ideas

Exit Ticket

After the CIA Triad Role-Play, provide students with three scenarios and ask them to identify which aspect of the CIA triad is most compromised in each, explaining their reasoning in one sentence per scenario.

Quick Check

During the Threat Mapping Boards, ask students to categorize common threats (phishing email, ransomware, DDoS attack, password brute force) based on their primary goal, then review answers as a class to address misconceptions.

Discussion Prompt

After the Password Cracking Contest, pose the question: 'Why is simply having a strong password not enough to protect your online accounts?' Facilitate a discussion where students explain limitations of passwords and benefits of multi-factor authentication, referencing examples from the contest.

Extensions & Scaffolding

• Challenge: Ask students to design a phishing email tailored to a peer, then have the class vote on detection difficulty.
• Scaffolding: Provide a partially completed threat map template for students to fill in key details, focusing on one threat type at a time.
• Deeper exploration: Invite a cybersecurity professional to discuss how the CIA triad applies in their daily work, connecting classroom learning to industry practices.

Key Vocabulary

Confidentiality	Ensuring that information is accessible only to those authorized to have access. This prevents unauthorized disclosure of sensitive data.
Integrity	Maintaining the consistency and accuracy of data over its entire lifecycle. It ensures data has not been altered or corrupted.
Availability	Ensuring that systems, applications, and data are accessible and usable when needed by authorized users. This prevents disruption of services.
Malware	Malicious software designed to disrupt, damage, or gain unauthorized access to computer systems. Examples include viruses, worms, and ransomware.
Phishing	A cyber attack where attackers impersonate trustworthy entities to trick individuals into revealing sensitive information, such as passwords or credit card details.
Denial-of-Service (DoS) Attack	An attack intended to shut down a machine or network, making it inaccessible to its intended users by overwhelming it with traffic.