Computer Science · 9th Grade

Active learning ideas

Human Factors in Cybersecurity

Active learning works for this topic because human-centered cybersecurity is about behavior, not just knowledge. Students need to practice recognizing manipulation tactics and making decisions under realistic pressure to internalize why human factors matter.

• Common Core State Standards
• CSTA: 3A-NI-06

• 20–40 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 25 min · Pairs

Role-Play: Social Engineering Scenarios

Students work in pairs. One plays an attacker using a pretexting script, such as 'Hi, I'm from IT -- I need your password to fix your account.' The other plays the target, practicing how to verify the caller's identity and decline the request safely. Groups debrief on which techniques felt most convincing.

Explain how human factors contribute more to security breaches than technical failures.

Facilitation Tip

During Role-Play: Social Engineering Scenarios, assign specific roles so students experience the emotional triggers attackers use, such as urgency or flattery, in a low-stakes environment.

What to look for

Provide students with three short scenarios describing potential cyber threats. Ask them to identify the type of social engineering attack in each scenario and explain one specific action they would take to avoid falling victim.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Role Play
• 40 min · Small Groups

Collaborative Design: Security Awareness Campaign

Groups design a three-part security awareness program for their school: a poster, a five-minute activity, and a quick-reference card. They present their programs and the class votes on which is most likely to actually change behavior and why.

Analyze common social engineering techniques used in cyberattacks.

Facilitation Tip

When facilitating Collaborative Design: Security Awareness Campaign, rotate student teams through different campaign elements so they see how messaging changes for different audiences.

What to look for

Present students with a simulated phishing email. Ask them to highlight at least three red flags that indicate the email is malicious and explain why each is a warning sign.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 03

• Case Study Analysis
• 30 min · Small Groups

Case Study Analysis: Inside the Human Breach

Groups analyze the 2011 RSA SecurID breach, in which an employee opened a phishing email titled '2011 Recruitment Plan.' They identify every human decision point where the attack could have been stopped and propose process changes for each.

Design a training program to improve human cybersecurity awareness.

Facilitation Tip

In Case Study Analysis: Inside the Human Breach, have students annotate the timeline of events with psychological triggers they identify in the breach narrative.

What to look for

Facilitate a class discussion using the prompt: 'Imagine you receive a phone call from someone claiming to be from your internet provider, stating your service will be disconnected unless you immediately provide your account password. How would you respond, and why is this a common social engineering tactic?'

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 04

• Think-Pair-Share
• 20 min · Pairs

Think-Pair-Share: Why Do People Fall For It?

Students individually list three cognitive biases that social engineers exploit, such as urgency, authority, or familiarity. Pairs combine their lists and find examples of each in real phishing messages. The class builds a master list of psychological levers attackers use.

Explain how human factors contribute more to security breaches than technical failures.

Facilitation Tip

Use Think-Pair-Share: Why Do People Fall For It? to first isolate individual assumptions, then build consensus in small groups before whole-class discussion.

What to look for

Provide students with three short scenarios describing potential cyber threats. Ask them to identify the type of social engineering attack in each scenario and explain one specific action they would take to avoid falling victim.

• Understand
• Apply
• Analyze
• Self-Awareness
• Relationship Skills

A few notes on teaching this unit

Experienced teachers approach this topic by normalizing mistakes and reframing ‘human error’ as a predictable outcome of cognitive shortcuts. Avoid shaming students for falling for fake scenarios; instead, use those moments to teach resilience. Research shows that scenario-based practice reduces real-world vulnerability more than lectures alone. Keep the tone practical and solution-focused.

Successful learning looks like students applying critical thinking to real-world scenarios, designing clear security messages for peers, and articulating why humans are the weakest link in cybersecurity. They should move from passive awareness to active defense.

---

Watch Out for These Misconceptions

• During Role-Play: Social Engineering Scenarios, watch for students assuming only careless or uneducated people fall for phishing. Redirect by having them debrief after each role-play, highlighting how even IT professionals get tricked by well-crafted spear-phishing emails.

  During Role-Play: Social Engineering Scenarios, use the debrief to point out that attackers exploit universal human traits like urgency and authority, which affect everyone. Share real-world examples of security researchers being phished to normalize vulnerability.

• During Collaborative Design: Security Awareness Campaign, watch for students believing better software will eliminate the human problem. Redirect by asking them to research high-profile breaches caused by human error and present findings to the class.

  During Collaborative Design: Security Awareness Campaign, have students include a slide in their campaign about why software alone cannot fix human psychology. Use case studies like the 2016 Democratic National Committee breach to illustrate this point.

---

Methods used in this brief

• Role Play
• Case Study Analysis
• Think-Pair-Share