Computer Science · 9th Grade · The Architecture of the Internet · Weeks 10-18

Cybersecurity Threats and Defenses

Students will identify common cybersecurity threats and explore various defense mechanisms.

• Common Core State Standards
• CSTA: 3A-NI-06
• CSTA: 3A-NI-07

About This Topic

Cybersecurity threats range from automated attacks targeting thousands of systems simultaneously to carefully crafted messages aimed at a single individual. For 9th graders in the United States, this topic grounds the abstract concept of 'security' in specific, named attack categories. Phishing uses deceptive communication to steal credentials or install malware. Malware is software designed to damage, disrupt, or gain unauthorized access to systems. Distributed Denial of Service (DDoS) attacks flood a server with traffic to make it unavailable to legitimate users. Understanding the mechanics of each attack type is the prerequisite for evaluating defenses.

Defenses are not one-size-fits-all. Firewalls filter network traffic by rules but cannot stop a user who clicks a malicious link. Antivirus software detects known malware signatures but misses novel variants. Multi-factor authentication stops credential theft but not all social engineering. Students learn that a layered defense strategy -- defense in depth -- is more robust than any single measure.

This topic benefits from active learning because threat analysis requires students to think like an attacker before they can design defenses. Simulating attack scenarios and constructing countermeasures builds genuine analytical fluency, not just vocabulary memorization.

Key Questions

1. Analyze common cybersecurity threats such as phishing, malware, and DDoS attacks.
2. Construct a basic defense strategy against a specified cyber threat.
3. Evaluate the effectiveness of different security measures (e.g., firewalls, antivirus).

Learning Objectives

• Analyze the common characteristics and delivery methods of phishing attacks.
• Classify different types of malware (e.g., viruses, worms, ransomware) based on their behavior.
• Design a multi-layered defense strategy to protect a small online business from a specified cyber threat.
• Evaluate the effectiveness of firewalls and antivirus software in mitigating specific attack vectors.
• Compare and contrast the strengths and weaknesses of single-factor versus multi-factor authentication.

Before You Start

Basic Computer Networking Concepts

Why: Understanding how data travels across networks is fundamental to grasping how attacks propagate and how network defenses work.

Introduction to Software and Applications

Why: Students need a foundational understanding of what software is to comprehend how malware functions and how to protect against it.

Key Vocabulary

Phishing	A social engineering attack that uses deceptive emails, messages, or websites to trick individuals into revealing sensitive information or downloading malware.
Malware	Malicious software designed to disrupt, damage, or gain unauthorized access to computer systems, including viruses, worms, trojans, and ransomware.
DDoS Attack	Distributed Denial of Service attack, which overwhelms a server or network with a flood of internet traffic, making it inaccessible to legitimate users.
Firewall	A network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security rules.
Antivirus Software	A program designed to detect, prevent, and remove malicious software from computers and networks.
Multi-Factor Authentication (MFA)	A security process that requires users to provide two or more verification factors to gain access to a resource, such as a password and a code from a phone.

Watch Out for These Misconceptions

Common Misconception

Antivirus software is enough to keep a computer secure.

What to Teach Instead

Antivirus covers only one attack vector and only catches known threats. Case study analysis of real breaches -- most of which involve multiple threat types working together -- shows students concretely why layered defenses are necessary.

Common Misconception

Strong technical defenses make human error irrelevant.

What to Teach Instead

Most breaches involve a human component, often credential theft via phishing. Even robust technical infrastructure can be undermined by a single user clicking the wrong link. The phishing email spotting activity makes this gap visible and non-judgmental.

Active Learning Ideas

Collaborative Case Study: Anatomy of a Breach

Groups receive a detailed account of a real breach, such as the 2021 Colonial Pipeline ransomware attack, and must reconstruct the attack timeline, identify which defenses failed, and propose what could have prevented each step. Each group presents their analysis to the class.

45 min·Small Groups

Think-Pair-Share: Phishing Email Spotting

Students individually examine a set of four emails, two phishing and two legitimate, and identify every suspicious element. They pair to compare and discuss any indicators they missed, then the class builds a shared phishing red-flag checklist on the board.

25 min·Pairs

Design Challenge: Defense Strategy

Each group plays the role of a school IT director with a $10,000 security budget. They must allocate across five defense categories (firewall, antivirus, staff training, MFA, and backup) and justify each allocation. Groups share strategies and debate the tradeoffs.

35 min·Small Groups

Jigsaw: Threat Encyclopedia

Expert groups each research one threat type in depth: phishing, ransomware, DDoS, or social engineering. They return to mixed groups to brief their peers, then the full class maps each threat to the defenses that address it on a shared matrix.

40 min·Small Groups

Real-World Connections

• Financial institutions like Chase Bank use sophisticated firewalls and intrusion detection systems to protect customer accounts from unauthorized access and phishing attempts.
• Cybersecurity analysts at companies like Google work to identify new malware strains and develop patches and security updates to protect billions of users worldwide.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) provides resources and alerts to help individuals and organizations defend against common threats like ransomware attacks that can cripple critical services.

Assessment Ideas

Exit Ticket

Provide students with three brief scenarios describing potential cyber threats. Ask them to identify the primary threat in each scenario (e.g., phishing, malware, DDoS) and suggest one specific defense mechanism that could be used.

Quick Check

Present a list of common cybersecurity terms. Ask students to match each term with its correct definition. Follow up by asking students to explain, in one sentence, why understanding these terms is important for online safety.

Discussion Prompt

Pose the question: 'If you were advising a friend on how to stay safe online, what are the top three pieces of advice you would give them, and why?' Encourage students to reference specific threats and defenses discussed in class.

Frequently Asked Questions

What is the difference between a virus and malware?

Malware is the broad category covering all malicious software: viruses, ransomware, spyware, trojans, and more. A virus is a specific type of malware that attaches itself to other programs and spreads. Ransomware encrypts your files and demands payment. Knowing the specific type helps identify the right defense.

How does a DDoS attack work?

A Distributed Denial of Service attack floods a server with traffic from thousands of compromised machines simultaneously, overwhelming its capacity to respond to legitimate requests. The distributed part means traffic comes from many sources, making it hard to block by IP address. Attackers typically use botnets of hijacked devices.

What is defense in depth?

Defense in depth is a security strategy using multiple independent layers of controls so that if one fails, others still provide protection. A school using defense in depth might run a firewall, require MFA for staff accounts, use antivirus on all devices, and train staff to recognize phishing -- no single layer is the sole protection.

How can active learning make cybersecurity more effective to teach?

Cybersecurity is learned by thinking like both attacker and defender. When students roleplay breach analysis or design defense strategies for realistic scenarios with budget constraints, they build threat intuition that watching a demonstration cannot replicate. The design challenge format forces tradeoff thinking that is central to actual security work.