Computing · Secondary 3

Active learning ideas

Introduction to Cybersecurity

Active learning helps students grasp abstract cybersecurity concepts by making them concrete and personal. When students sort real-world examples, role-play threats, and audit their own devices, they move beyond memorization to authentic understanding. This hands-on approach builds both technical knowledge and critical decision-making skills for digital safety.

• MOE Syllabus Outcomes
• MOE: Cybersecurity - S3

• 25–45 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Think-Pair-Share
• 35 min · Small Groups

Scenario Sort: Threat vs Vulnerability

Provide cards with 20 real-world scenarios, such as 'clicking suspicious email links' or 'outdated software.' In small groups, students sort them into threat, vulnerability, or risk categories, then justify choices on posters. Conclude with a class share-out to refine classifications.

Explain the fundamental reasons why cybersecurity is essential in the digital age.

Facilitation Tip

During the Personal Audit, provide a checklist that includes steps like checking software updates and password strength, so students have clear criteria for evaluation.

What to look for

Present students with three scenarios. For each, ask them to identify if it describes a threat, a vulnerability, or a risk. For example: 'An attacker sends an email with a malicious link' (threat), 'A company uses the default password for its server' (vulnerability), 'A data breach leads to identity theft' (risk).

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

Activity 02

• Think-Pair-Share
• 30 min · Pairs

Phishing Role-Play: Spot the Scam

Pairs act out phishing emails or calls, one as attacker and one as victim. Switch roles, then debrief: identify red flags like urgent language or fake links. Groups vote on most convincing scams and suggest countermeasures.

Differentiate between a cyber threat and a vulnerability.

What to look for

Pose the question: 'Imagine your personal social media account is compromised. What are three specific negative impacts this could have on you?' Facilitate a class discussion, guiding students to consider privacy, reputation, and potential financial loss.

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

Activity 03

• Think-Pair-Share
• 45 min · Small Groups

Risk Impact Debate: Case Studies

Assign small groups famous cyberattacks like the SingHealth breach. They analyze threats, vulnerabilities exploited, and impacts, then debate mitigation strategies. Present findings using slides to the class.

Analyze the potential impact of a cyberattack on individuals and organizations.

What to look for

Ask students to write down one key difference between a cyber threat and a vulnerability. Then, have them list one reason why cybersecurity is important for Singapore's economy.

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

Activity 04

• Think-Pair-Share
• 25 min · Individual

Personal Audit: Secure My Device

Individually, students assess their devices or accounts against a checklist of vulnerabilities, like password strength or app permissions. Share anonymized results in pairs and create action plans.

Explain the fundamental reasons why cybersecurity is essential in the digital age.

What to look for

Present students with three scenarios. For each, ask them to identify if it describes a threat, a vulnerability, or a risk. For example: 'An attacker sends an email with a malicious link' (threat), 'A company uses the default password for its server' (vulnerability), 'A data breach leads to identity theft' (risk).

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

A few notes on teaching this unit

Start with what students already know about digital habits and build upward. Avoid overwhelming them with technical jargon upfront. Research shows that students retain concepts better when they first experience a problem emotionally, like fear or frustration, before learning solutions. Use Singaporean examples to make threats feel immediate, such as discussing how a fake e-commerce site might target local shoppers.

Successful learning is visible when students can distinguish between threats, vulnerabilities, and risks in new scenarios. They should confidently explain why cybersecurity matters to individuals and society, and demonstrate awareness of layered defenses. Group discussions should show empathy for potential impacts of cyber incidents on real people.

---

Watch Out for These Misconceptions

• During the Scenario Sort activity, watch for students who categorize all phishing emails as threats without recognizing that weak user awareness is also a vulnerability.

  Use the Sorting Cards activity to have students separate phishing emails into two piles: one for the threats (the emails themselves) and one for the vulnerabilities (user behaviors like clicking without checking). Ask them to explain how one leads to the other.

• During the Phishing Role-Play, watch for students who assume antivirus software will always catch scams.

  After the role-play, reveal a mock antivirus scan that 'misses' a phishing link. Ask students to identify what the antivirus couldn’t detect (e.g., social engineering) and add it to their personal audit checklist.

• During the Risk Impact Debate, watch for students who use 'threat' and 'vulnerability' interchangeably when discussing case studies.

  Pause the debate and have students label each part of the case study as threat, vulnerability, or risk. Require them to justify their choices using evidence from the scenario before continuing.

---

Methods used in this brief

• Think-Pair-Share