Computer Science · 10th Grade · Network Architecture and Web Systems · Weeks 19-27

Network Security Fundamentals

Students learn basic network security concepts, including firewalls, intrusion detection, and prevention systems.

• Common Core State Standards
• CSTA: 3A-NI-05

About This Topic

Network security is one of the most practical and immediately relevant topics in a 10th-grade computer science course. Students connect concepts like firewalls and intrusion detection systems to news stories they already know, from corporate breaches to ransomware outbreaks. A firewall acts as a rule-based gatekeeper between trusted internal networks and untrusted external ones, filtering traffic based on policies that administrators define. Intrusion detection systems (IDS) go further by monitoring traffic for suspicious patterns and alerting administrators when something looks wrong.

Students in US classrooms also benefit from learning the difference between active attacks (where an adversary actively injects or alters traffic) and passive attacks (like eavesdropping or traffic analysis). These distinctions are aligned with CSTA standard 3A-NI-05 and help students see security as a layered discipline rather than a single solution.

Active learning works especially well here because security scenarios are tangible and scenario-driven. When students role-play as attackers and defenders, they quickly internalize why each defense layer matters.

Key Questions

1. Explain the function of a firewall in network security.
2. Analyze how intrusion detection systems protect networks.
3. Differentiate between active and passive network attacks.

Learning Objectives

• Explain the function of a firewall as a traffic filtering mechanism between networks.
• Analyze the methods intrusion detection systems use to identify and alert on suspicious network activity.
• Differentiate between active and passive network attacks, providing examples of each.
• Evaluate the role of network security layers in protecting digital assets.
• Classify common network security threats based on their attack vector.

Before You Start

Basic Network Concepts

Why: Students need to understand fundamental networking terms like IP addresses, ports, and network topology to grasp how security devices operate.

Introduction to Cybersecurity Threats

Why: Prior exposure to common threats like malware and phishing helps students understand the 'why' behind network security measures.

Key Vocabulary

Firewall	A network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies.
Intrusion Detection System (IDS)	A device or software application that monitors a network or systems for malicious activity or policy violations and reports them.
Intrusion Prevention System (IPS)	A network security technology that monitors network and/or network activities for malicious activities or policy violations and can react in real-time to block or prevent them.
Packet Filtering	A firewall technique that examines the headers of network packets and decides whether to allow or block them based on rules.
Network Traffic Analysis	The process of monitoring network traffic to detect anomalies, security threats, or performance issues.

Watch Out for These Misconceptions

Common Misconception

A firewall alone makes a network secure.

What to Teach Instead

Firewalls filter traffic at a boundary but cannot stop threats that come through allowed ports, insider threats, or malware already inside the network. Discussing layered security in small groups helps students map the gaps a firewall leaves open.

Common Misconception

Intrusion detection systems automatically block attacks.

What to Teach Instead

Basic IDS systems detect and alert but do not block on their own. That is the role of an intrusion prevention system (IPS). Students often conflate these; role-play activities where one student can only 'shout a warning' while another takes action makes this distinction clear.

Common Misconception

Passive attacks are less dangerous because nothing is changed.

What to Teach Instead

Passive attacks like eavesdropping can harvest credentials and sensitive data without leaving a trace. Because nothing is altered, they are often harder to detect, making them particularly dangerous. Case studies illustrate this well.

Active Learning Ideas

Role-Play: Attack and Defend Simulation

Divide the class into attacker and defender teams. Attackers draw scenario cards describing a network intrusion method (port scan, SYN flood, packet sniff). Defenders must identify which security layer catches it and write a one-paragraph policy response. Teams then switch roles and debrief together.

40 min·Small Groups

Think-Pair-Share: Firewall Rules Analysis

Provide each student with a printed firewall ruleset (deny port 23, allow port 443, etc.) and a table of incoming packets. Students individually decide which packets get through, then pair up to reconcile differences, then share edge cases with the whole class.

25 min·Pairs

Jigsaw: Real-World Breach Postmortems

Assign each small group a documented breach (e.g., Target 2013, SolarWinds 2020). Groups analyze what network security controls failed and present a two-minute summary identifying the attack type and one defensive measure that would have helped.

50 min·Small Groups

Real-World Connections

• Cybersecurity analysts at financial institutions like JPMorgan Chase use firewalls and IDS to protect sensitive customer data and prevent fraudulent transactions from occurring.
• Network administrators for cloud service providers such as Amazon Web Services (AWS) implement sophisticated intrusion prevention systems to safeguard vast amounts of data hosted on their servers.
• IT security teams in hospitals like Mayo Clinic deploy firewalls to segment patient data networks from public-facing systems, preventing unauthorized access to electronic health records.

Assessment Ideas

Quick Check

Present students with three network scenarios. For each scenario, ask them to identify whether a firewall, IDS, or IPS would be the primary defense and briefly explain why. For example, 'A user clicks a malicious link and malware attempts to download. Which system is most likely to detect and block this?'

Discussion Prompt

Pose the question: 'Imagine you are designing security for a small business. What are the first three network security tools you would implement and why? How do these tools work together to create a layered defense?'

Exit Ticket

On an index card, have students define 'active attack' and 'passive attack' in their own words and provide one distinct example for each. Collect these to gauge understanding of attack types.

Frequently Asked Questions

What is the difference between a firewall and an antivirus program?

A firewall controls what network traffic enters or leaves a system based on rules, while antivirus software scans files and processes on a device for known malicious patterns. They address different threat vectors and are most effective when used together as part of a layered security strategy.

How does an intrusion detection system know what is suspicious?

IDS tools use two main methods: signature-based detection, which matches traffic against a database of known attack patterns, and anomaly-based detection, which flags behavior that deviates from a defined baseline. Both have trade-offs between false positives and missed detections.

What is the difference between active and passive network attacks?

Active attacks involve modifying or disrupting data, such as a man-in-the-middle attack or denial of service. Passive attacks involve monitoring or capturing data without changing it, such as eavesdropping. Passive attacks are harder to detect because no visible damage occurs.

How does active learning help students understand network security concepts?

Security scenarios benefit from role-play and simulation because abstract concepts like firewall rules and IDS alerts become concrete decisions with consequences. When students act as both attacker and defender, they build intuition for threat modeling that lecture alone rarely achieves.