Computer Science · 10th Grade

Active learning ideas

Network Security Fundamentals

Active learning works for network security because students can see the immediate consequences of security choices, which builds both technical understanding and critical thinking. When students simulate attacks and defenses, they connect abstract concepts like firewalls and IDS to real-world impacts they recognize from news stories.

• Common Core State Standards
• CSTA: 3A-NI-05

• 25–50 min
• Pairs → Whole Class
• 3 activities

Activity 01

• Carousel Brainstorm
• 40 min · Small Groups

Role-Play: Attack and Defend Simulation

Divide the class into attacker and defender teams. Attackers draw scenario cards describing a network intrusion method (port scan, SYN flood, packet sniff). Defenders must identify which security layer catches it and write a one-paragraph policy response. Teams then switch roles and debrief together.

Explain the function of a firewall in network security.

Facilitation Tip

During the Attack and Defend Simulation, circulate and listen for students to explicitly name the security tools they are using and why.

What to look for

Present students with three network scenarios. For each scenario, ask them to identify whether a firewall, IDS, or IPS would be the primary defense and briefly explain why. For example, 'A user clicks a malicious link and malware attempts to download. Which system is most likely to detect and block this?'

• Remember
• Understand
• Analyze
• Relationship Skills
• Social Awareness

Activity 02

• Think-Pair-Share
• 25 min · Pairs

Think-Pair-Share: Firewall Rules Analysis

Provide each student with a printed firewall ruleset (deny port 23, allow port 443, etc.) and a table of incoming packets. Students individually decide which packets get through, then pair up to reconcile differences, then share edge cases with the whole class.

Analyze how intrusion detection systems protect networks.

Facilitation Tip

In the Firewall Rules Analysis, ask pairs to justify their rule decisions by referencing specific traffic patterns from the scenario.

What to look for

Pose the question: 'Imagine you are designing security for a small business. What are the first three network security tools you would implement and why? How do these tools work together to create a layered defense?'

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

Activity 03

• Jigsaw
• 50 min · Small Groups

Jigsaw: Real-World Breach Postmortems

Assign each small group a documented breach (e.g., Target 2013, SolarWinds 2020). Groups analyze what network security controls failed and present a two-minute summary identifying the attack type and one defensive measure that would have helped.

Differentiate between active and passive network attacks.

Facilitation Tip

For the Real-World Breach Postmortems, assign roles so each group member investigates a different aspect of the breach to ensure full participation.

What to look for

On an index card, have students define 'active attack' and 'passive attack' in their own words and provide one distinct example for each. Collect these to gauge understanding of attack types.

• Understand
• Analyze
• Evaluate
• Relationship Skills
• Self-Management

A few notes on teaching this unit

Teachers should emphasize that network security is not about single solutions but about layers of defenses working together. Avoid treating firewalls and IDS as standalone magic bullets; instead, model how to analyze gaps in a single layer's coverage. Research shows students grasp layered security best when they see the consequences of bypassing or misconfiguring one layer.

Successful learning looks like students explaining why a layered security approach matters, distinguishing between detection and prevention, and applying firewall rules to realistic traffic patterns. They should also critique security setups and justify their choices with evidence from case studies.

---

Watch Out for These Misconceptions

• During Role-Play: Attack and Defend Simulation, watch for students assuming the firewall alone will stop all attacks.

  Use the simulation to highlight that firewalls filter traffic but cannot stop threats that come through allowed ports or from inside the network. Have students map out what the firewall misses and discuss how an IDS would detect those gaps.

• During Think-Pair-Share: Firewall Rules Analysis, watch for students believing IDS systems automatically block attacks.

  After the Think-Pair-Share, have students physically separate their hands into 'alert only' and 'block' categories to contrast IDS and IPS roles. Use their rule sets to show how IDS alerts inform but do not enforce policies.

• During Case Study Jigsaw: Real-World Breach Postmortems, watch for students dismissing passive attacks as harmless because no changes occur.

  In the jigsaw, assign one group to focus on passive attacks and present how data harvesting can lead to active breaches. Use the case study’s timeline to show how passive attacks often precede more damaging active attacks.

---

Methods used in this brief

• Carousel Brainstorm
• Think-Pair-Share
• Jigsaw