Computer Science · 10th Grade

Active learning ideas

Common Software Security Flaws

Active learning makes abstract security concepts concrete by putting students in the roles of responders, judges, and analysts. When students simulate a breach, argue ethics in a trial, or analyze real cases, they practice decision-making that textbooks alone cannot teach.

• Common Core State Standards
• CSTA: 3A-NI-05
• CSTA: 3A-NI-07

• 35–60 min
• Pairs → Whole Class
• 3 activities

Activity 01

• Simulation Game
• 60 min · Whole Class

Simulation Game: The 48-Hour Breach Response

The class is divided into 'Tech,' 'Legal,' and 'PR' teams. They are given a scenario where customer data has been leaked and must work together to contain the breach, notify the public, and follow legal requirements within a strict time limit.

Explain common software security flaws like weak input validation.

Facilitation Tip

During the simulation, assign each student a role card with clear constraints so they experience how real-world teamwork limits individual choices.

What to look for

Present students with short code snippets. Ask them to identify any potential security flaws and explain why it is a vulnerability. For example: 'Given this Python code that takes user input for a database query, what is the main security risk?'

• Apply
• Analyze
• Evaluate
• Create
• Social Awareness
• Decision-Making

Activity 02

• Mock Trial
• 50 min · Whole Class

Mock Trial: The Ethical Hacker

A student is 'on trial' for accessing a company's server without permission to point out a security flaw. The class acts as the prosecution, defense, and jury to debate whether the student's intent justifies their illegal actions.

Analyze how insecure coding practices can create vulnerabilities.

Facilitation Tip

When running the mock trial, provide a script starter but allow students to improvise testimony based on case files to deepen engagement.

What to look for

Facilitate a class discussion using the prompt: 'Imagine you are a developer who has just discovered a serious security flaw in your company's popular application. What are the immediate steps you should take, and why is it crucial to address this flaw before releasing an update?'

• Analyze
• Evaluate
• Create
• Decision-Making
• Social Awareness

Activity 03

• Gallery Walk
• 35 min · Small Groups

Gallery Walk: Case Studies in Crisis

Display posters of famous real-world data breaches (e.g., Equifax, Target). Students move in groups to analyze what went wrong in the response phase and use sticky notes to suggest what the companies should have done differently.

Propose basic coding practices to prevent common software security flaws.

Facilitation Tip

For the gallery walk, have students rotate in small groups and annotate case posters with sticky notes that name the flaw, its impact, and a fix.

What to look for

Ask students to write down two common software security flaws and, for each, one specific coding practice that can help prevent it. For instance: 'Flaw: SQL Injection. Prevention: Use parameterized queries.'

• Understand
• Apply
• Analyze
• Create
• Relationship Skills
• Social Awareness

A few notes on teaching this unit

Teachers should balance technical instruction with ethical framing, because students often focus on ‘fixing the code’ while overlooking legal and reputational consequences. Use real-world timelines to show how early missteps compound damage. Research suggests that scenario-based learning improves retention more than lectures when students must justify their actions to peers.

By the end of these activities, students will confidently distinguish between ethical response and legal missteps, justify containment steps, and critique flawed software with technical precision and ethical awareness.

---

Watch Out for These Misconceptions

• During Mock Trial: The Ethical Hacker, watch for statements that claim intent excuses illegal access.

  Use the jury instructions handout and case law excerpts to redirect students: ask them to compare the hacker’s actions with the Computer Fraud and Abuse Act language to see that intent does not negate unauthorized access.

• During Simulation: The 48-Hour Breach Response, watch for teams that want to notify users immediately.

  Have students consult the containment playbook in their role packets, which lists the order of operations: isolate systems, validate evidence, then decide on disclosure timing based on legal guidance.

---

Methods used in this brief

• Simulation Game
• Mock Trial
• Gallery Walk