Computer Science · 12th Grade

Active learning ideas

Operating System Security

Active learning works for operating system security because students need to see how permission systems behave in real environments, not just hear about them. Working with actual file systems, CVE descriptions, and authentication tools makes abstract concepts like privilege escalation and access control visible and memorable.

• Common Core State Standards
• CSTA: 3B-NI-04
• CCSS.ELA-LITERACY.RST.11-12.3

• 50–75 min
• Pairs → Whole Class
• 3 activities

Activity 01

• Problem-Based Learning
• 60 min · Small Groups

Format Name: Authentication Method Debate

Students research different authentication methods (passwords, MFA, biometrics). They then participate in a structured debate, arguing for the most secure and practical method for various scenarios, such as online banking or school network access.

Explain how operating systems enforce access control and user permissions.

Facilitation Tip

During the File Permission Audit, have students record exact commands and their outputs to trace how permission changes affect access, then compare findings in small groups.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management
• Relationship Skills

Activity 02

• Problem-Based Learning
• 50 min · Small Groups

Format Name: Access Control Scenario Analysis

Present students with several real-world scenarios involving user access to sensitive data (e.g., medical records, financial information). In small groups, they must design an appropriate access control policy, justifying their choices based on DAC and MAC principles.

Analyze common operating system vulnerabilities and how they are exploited.

Facilitation Tip

For the Case Study Analysis, assign each student or pair one CVE to present to the class, focusing on how privilege levels played a role in the exploit.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management
• Relationship Skills

Activity 03

• Problem-Based Learning
• 75 min · Individual

Format Name: Vulnerability Simulation Lab

Using a controlled virtual environment, students attempt to exploit common OS vulnerabilities (e.g., weak passwords, outdated software) to gain unauthorized access. This is followed by a debrief on how to patch and prevent these exploits.

Critique the effectiveness of different authentication methods in securing user accounts.

Facilitation Tip

Structure the Structured Debate with clear roles: one team argues for biometrics, one for hardware tokens, and one for password managers, requiring each to cite at least two technical advantages and disadvantages.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management
• Relationship Skills

A few notes on teaching this unit

Teachers approach operating system security by grounding lessons in real systems students can manipulate, not just slides. Research shows hands-on labs with immediate feedback help students recognize subtle permission behaviors that lead to vulnerabilities. Avoid rushing through privilege concepts—let students experience the frustration of locked files or elevated process access before explaining how to prevent it.

Successful learning looks like students explaining why a standard user account limits malware impact during the permission audit, identifying kernel-level risks in CVE write-ups, and comparing authentication methods based on concrete trade-offs they’ve researched. They should connect these experiences to broader security principles like least privilege and defense in depth.

---

Watch Out for These Misconceptions

• During the File Permission Audit, watch for students who assume administrator privileges are always necessary for software installation. Redirect them to compare the system folders and registry keys accessible under admin versus standard accounts.

  During the audit, have students attempt to install a dummy application as both an admin and a standard user. Ask them to list which system directories or settings each account could modify, making the risk of elevated malware tangible.

• During the Case Study Analysis, expect some students to believe a strong password alone prevents all unauthorized access. Redirect them to examine CVEs where physical access, kernel exploits, or misconfigured services bypassed authentication entirely.

  During the CVE analysis, have students highlight which privilege levels the attacker needed to exploit the vulnerability. Ask them to categorize each CVE by whether it required local access, remote network access, or physical presence.

• During the Structured Debate, some students may claim antivirus software makes operating system security redundant. Redirect them to examine how antivirus tools interact with the OS kernel and why kernel-level protections matter regardless of third-party tools.

  During the debate, require each team to explain at least one security mechanism that operates below the level of antivirus software, such as kernel patch protection or mandatory access control, and justify why third-party tools cannot replace them.

---

Methods used in this brief

• Problem-Based Learning