Computer Science · 10th Grade

Active learning ideas

Authentication and Authorization

Active learning helps students grasp the practical differences between authentication and authorization by moving from abstract definitions to concrete, relatable scenarios. When students physically compare methods or design systems, they internalize distinctions that lectures alone often leave blurry.

• Common Core State Standards
• CSTA: 3A-NI-06
• CSTA: 3A-NI-08

• 25–50 min
• Pairs → Whole Class
• 3 activities

Activity 01

• Stations Rotation
• 40 min · Small Groups

Comparative Matrix: Authentication Method Trade-offs

Provide small groups with a table listing six authentication methods (password, PIN, SMS OTP, authenticator app, fingerprint, hardware key) and four evaluation criteria (security strength, cost, user friction, recovery if lost). Groups fill in the matrix and rank the methods for three specific use cases: a social media account, a hospital records system, and a personal phone.

Compare the strengths and weaknesses of various authentication methods.

Facilitation Tip

During the Comparative Matrix, circulate to listen for students who are conflating authentication and authorization and ask guiding questions like 'Is this about proving who you are or what you can access?'

What to look for

Provide students with three scenarios: 1) logging into a personal email, 2) a doctor accessing patient records, 3) a gamer accessing a private server. Ask them to identify the primary authentication method used in each and suggest one additional security measure (MFA or authorization principle) that should be applied and why.

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

Activity 02

• Think-Pair-Share
• 25 min · Pairs

Think-Pair-Share: Why Passwords Fail

Students individually list every reason a strong password policy might still fail in practice (reuse, phishing, database breaches, shoulder surfing). Pairs combine lists and categorize by human vs. technical causes. The class builds a shared catalog, then discusses which MFA factor addresses each failure mode.

Explain the concept of multi-factor authentication (MFA).

Facilitation Tip

During the Think-Pair-Share, intentionally seed one incorrect statement about passwords (e.g., 'Long passwords are always more secure') to prompt deeper analysis during the pair discussion.

What to look for

Pose the question: 'If a company has to choose between a highly secure but inconvenient authentication method and a less secure but very convenient one, how should they decide?' Facilitate a discussion where students debate the balance between security and usability, referencing specific authentication types.

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

Activity 03

• Stations Rotation
• 50 min · Small Groups

Design Challenge: Access Control for a School System

Small groups are given a scenario: design the authentication and authorization system for a K-12 school, with roles for students, teachers, counselors, and administrators. Each role has different data access needs. Groups must specify the authentication method and access permissions for each role, then present and defend their choices to the class.

Analyze how authorization controls access to resources.

Facilitation Tip

During the Design Challenge, limit the tools to only paper and markers so students focus on role definitions and permission logic instead of technology aesthetics.

What to look for

Present students with a list of access permissions (e.g., 'read file', 'write file', 'delete file', 'administer system'). Ask them to assign these permissions to hypothetical roles like 'User', 'Editor', and 'Administrator', demonstrating their understanding of authorization principles.

• Remember
• Understand
• Apply
• Analyze
• Self-Management
• Relationship Skills

A few notes on teaching this unit

Teach this topic by alternating between concrete experiences and reflective analysis. Start with familiar examples like logging into school accounts, then introduce structured tools like matrices to organize thinking. Avoid leading with jargon—anchor concepts in students' lived experiences before formalizing definitions. Research shows that separating the two concepts visually (e.g., using different colored sticky notes for authentication vs authorization) reduces confusion more effectively than verbal explanations alone.

By the end of these activities, students should clearly separate authentication from authorization in both discussions and designs. They should justify trade-offs between security and usability and apply access control principles to real-world systems.

---

Watch Out for These Misconceptions

• During Comparative Matrix: Authentication Method Trade-offs, watch for students who label all methods as equally 'secure' without considering context such as threat models or usability constraints.

  Use the matrix columns to explicitly ask students to rate each method on security, convenience, and revocability, then guide them to explain why a fingerprint scanner might be appropriate for a phone but not for a bank vault.

• During Think-Pair-Share: Why Passwords Fail, watch for students who assume longer passwords are always better without considering memorability or entropy trade-offs.

  Direct students back to the password strength rubric used in the activity and ask them to revise their statements by referencing specific criteria like character variety and length limits.

---

Methods used in this brief

• Stations Rotation
• Think-Pair-Share