Threat Landscape: Malware and Viruses

Active learning works because students need to see malware behavior in action to grasp abstract differences between viruses, worms, and ransomware. Simulations and card sorts let students experience propagation methods firsthand, making technical distinctions memorable and discussion-ready.

• Secondary 4
• Computing
• 4 activities
• 25 min–45 min

Learning Objectives

1. Classify common types of malware, including viruses, worms, and ransomware, based on their propagation and operational characteristics.
2. Compare and contrast the methods by which viruses and worms spread through computer networks.
3. Analyze the potential impact of ransomware attacks on individual users and organizations, considering data encryption and financial loss.
4. Predict the likely behavior and spread patterns of a hypothetical new malware variant given its described characteristics.

Case Study Analysis

⏱ 45 min·Small Groups

Simulation Lab: Malware Propagation

Use a simple network simulator app or string-and-cup model to represent computers. Assign roles: one group introduces a 'worm' that spreads by passing strings, another a 'virus' needing file activation. Students track spread speed and infection points over rounds, then discuss prevention.

Prepare & details

How do different types of malware propagate through a network?

Facilitation Tip: For the Simulation Lab, set clear boundaries for the lab environment to prevent actual data loss. Use a sandbox tool like VirtualBox with snapshots so students can safely restart after mistakes.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 30 min·Pairs

Case Study Dissection: Real Ransomware

Provide printed or digital case studies of WannaCry and similar attacks. In pairs, students identify entry methods, impacts, and responses. They create flowcharts showing operation sequences and present findings to the class.

Prepare & details

Differentiate between a virus, a worm, and ransomware.

Facilitation Tip: During Case Study Dissection, assign roles so each pair has a note-taker, researcher, and presenter. Rotate roles to keep all students engaged and accountable.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 25 min·Small Groups

Classification Sort: Threat Cards

Distribute cards describing malware behaviors. Groups sort them into virus, worm, ransomware piles, justifying choices with evidence. Follow with a class vote and correction round using official definitions.

Prepare & details

Predict the impact of a new, unknown type of malware on a typical computer system.

Facilitation Tip: For Classification Sort, provide a mix of real-world and hypothetical examples on cards. Have students justify their placements aloud to reinforce terminology and reasoning.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Case Study Analysis

⏱ 35 min·Whole Class

Prediction Challenge: Unknown Malware

Present a hypothetical new malware scenario. Individually, students predict spread and impacts on a school network, then share in whole class discussion to refine predictions based on prior classifications.

Prepare & details

How do different types of malware propagate through a network?

Facilitation Tip: In the Prediction Challenge, give students limited time to analyze logs or code snippets. This mimics real-world incident response pressure and sharpens analytical skills.

Setup: Groups at tables with case materials

Materials: Case study packet (3-5 pages), Analysis framework worksheet, Presentation template

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Teaching This Topic

Teachers should start with clear definitions but quickly move to concrete examples that students can manipulate. Avoid over-reliance on lectures about malware types; instead, use activities where students classify, simulate, and predict outcomes. Research shows hands-on cybersecurity tasks improve retention, especially when students see immediate cause-and-effect, like watching a worm spread in a sandbox.

What to Expect

Successful learning shows when students can explain propagation methods, classify unseen malware types, and predict impacts on systems. They should confidently use terms like 'host file,' 'autonomous replication,' and 'encryption' to describe threats.

Watch Out for These Misconceptions

Common Misconception

During Classification Sort: Threat Cards, watch for students who group all malware together as the same type.

What to Teach Instead

Use the card sort to redirect their attention to the propagation method listed on each card, such as 'requires user execution' or 'self-replicates.' Ask them to physically move cards into columns labeled with propagation traits to force comparison.

Common Misconception

During Case Study Dissection: Real Ransomware, watch for students who assume ransomware only affects large organizations.

What to Teach Instead

Have pairs analyze case studies that include personal device examples, like a school email scam or a mobile phone infection. Ask them to highlight the entry point (email or download) and the target (data encryption) to connect ransomware to everyday risks.

Common Misconception

During Prediction Challenge: Unknown Malware, watch for students who believe antivirus software always stops malware immediately.

What to Teach Instead

Use the logs or code snippets in this activity to show varied detection outcomes. Ask students to note where detection failed and why, then discuss how layered defenses (like firewalls plus antivirus) reduce but don't eliminate risks.

Assessment Ideas

Quick Check

After Simulation Lab: Malware Propagation, present students with short scenarios describing malware behavior. Ask them to identify the type of malware (virus, worm, ransomware) and briefly explain their reasoning, citing specific actions like 'attaches to a file' or 'spreads without user input'.

Discussion Prompt

During Case Study Dissection: Real Ransomware, facilitate a class discussion using the prompt: 'Imagine a new piece of malware is discovered that can spread through email attachments but also replicate itself to other computers on the same network. What are the immediate concerns, and how would you advise a small business in Singapore to protect itself?' Use the case study pairs to lead the conversation.

Exit Ticket

After Prediction Challenge: Unknown Malware, have students define one key vocabulary term in their own words on an index card and list one difference in how a virus and a worm propagate. Collect these as students leave to gauge understanding of core concepts.

Extensions & Scaffolding

• Challenge: Ask students to design a ransomware scenario that targets a school network. Have them write a short policy recommendation for the school on preventing such an attack.
• Scaffolding: For students struggling with the Classification Sort, provide a pre-sorted anchor chart with key traits for each malware type. Have them compare their cards to the chart before finalizing placements.
• Deeper Exploration: Invite a cybersecurity professional to discuss how antivirus software detects and blocks different malware types. Prepare guiding questions in advance to focus the discussion on detection challenges.

Key Vocabulary

Virus	A type of malware that attaches itself to legitimate files or programs and requires user action to spread, often corrupting or modifying files.
Worm	A standalone malware program that replicates itself and spreads across networks autonomously, often exploiting security vulnerabilities without user interaction.
Ransomware	Malware that encrypts a victim's files, demanding a ransom payment for the decryption key, thereby holding data hostage.
Propagation	The process by which malware spreads from one system or network to another, either through user action or autonomous replication.
Payload	The part of a malware program that performs the malicious action, such as deleting files, stealing data, or encrypting data.