The shape of the lesson
By the end of the lesson, learners can
- Threats from the network: In the lab, match each threat with the defences that work against it, test some passwords, then find the giveaway signs in a phishing email.
- From one PC to a network: The syllabus asks for measures that protect anything from a single stand-alone PC up to a network of computers.
- Protect the data itself: Measures against the system's attackers may fail, so the data needs its own protection.
- Name and describe: say what the threat is and what harm it does.
- Match: pick the measure that actually stops that threat.
- Explain how: a firewall filters traffic by rules; anti-virus compares with signatures; encryption makes data unintelligible.
- Context: a stand-alone PC and a network need different measures; use the scenario in the question.
One picture every idea returns to
A network lets threats reach a computer from anywhere. Malware is software written to cause harm: a virus copies itself into other files and can delete or corrupt data; spyware secretly records what the user does, such as key presses, and sends it to a third party. Hackers gain unauthorised access to a system. Phishing uses a genuine-looking email to lure the user to a fake website; pharming installs code or alters DNS so the user is redirected to a fake website even when the correct address is typed. Each threat is reduced by a matching measure: firewall, anti-virus, anti-spyware, passwords and access rights, and encryption.
Forty-five minutes, phase by phase
| Time | Phase | What happens in the room | Grouping |
|---|---|---|---|
| 0 to 5 min | Hook: predict | Open with the question in the title, Know the attack.. Connecting a computer to a network or the internet opens it up to malware, hackers and tricks such as phishing and pharming. Put the figure on the board: it is the one picture every idea in the lesson returns to. | Whole class, then pairs |
| 5 to 13 min | Teach and check: Threats from the network | In the lab, match each threat with the defences that work against it, test some passwords, then find the giveaway signs in a phishing email. Project tab 5 of the lab (Cyber security threats and defences) and let a student drive it while the class predicts. | Whole class, then pairs |
| 13 to 21 min | Teach and check: From one PC to a network | The syllabus asks for measures that protect anything from a single stand-alone PC up to a network of computers. Model the worked example Describe a measure on the board, one line at a time. Your turn: A user's bank password was stolen even though she only ever typed it on the genuine bank website. Name the most likely threat and one measure that would have helped. | Pairs |
| 21 to 30 min | Teach and check: Protect the data itself | Measures against the system's attackers may fail, so the data needs its own protection. Model the worked example Matching measure to risk on the board, one line at a time. | Cooperative Concept Mapping |
| 30 to 36 min | Check | The four Stage 1 questions from the student lesson, answered on mini whiteboards or by show of fingers. Re-teach the one most get wrong. | Individual, then whole class |
| 36 to 43 min | Plenary | The exam-style questions from Stage 2, one at a time: thirty seconds alone, then a random call. The feedback lines in the key give the examiner's wording. | Individual, random call |
| 43 to 45 min | Exit and homework | Set the worksheet below (6 questions, 19 marks). Learners self-assess against the objectives before they leave. | Individual |
Protect the parts that carry the learning
The sequence carries about fifty minutes of material, so the lab is driven by one student while the class predicts rather than explored freely. Times are a guide.
Protected: the check at 30 minutes. It is the only individual read on whether the key idea landed, and it is not cut.
Cut first if the build overruns: the last check in Protect the data itself, never the check or the plenary.
In a 60 minute block: run worksheet questions 1 to 3 in class as a Rally Coach set and model both the hardest worked example and its check live.
Cooperative Concept Mapping
Teams receive the key terms on cards and arrange them on a large sheet, drawing and labelling the links. Compare maps between teams before showing the model map.
The full structure, with its variations and the other twelve, is on the cooperative-learning page.
What to head off, and how
| Trap learners fall into | Teaching move that pre-empts it |
|---|---|
| Phishing and pharming are easy to mix up. | In phishing the user has to click a link in a message; in pharming the user types the genuine address and is redirected without doing anything wrong. |
| Do not offer "anti-virus" or "firewall" as the answer to every threat. | Match the measure to the threat, and explain how that measure stops that threat. |
Threats to computer systems and how to protect them: worksheet
6 questions, 19 marks. Written in the style of the papers; no past paper question is reproduced.
Explain the difference between phishing and pharming.
Describe what is meant by spyware.
Describe how anti-virus software protects a computer.
A small business has four stand-alone PCs that it is about to connect to a LAN with internet access. Identify two new threats the connection introduces, and for each describe a measure that reduces the risk.
A manager says: "We have a firewall, so our data is completely secure." Give three reasons why this is not true.
Describe three rules a company could set for passwords to reduce the risk of hacking.
Answer key and marking notes
- Phishing: the user receives an email or message that appears to come from a genuine organisation.
- Phishing: the user clicks a link in the message and is taken to a fake website where they enter personal details.
- Pharming: malicious code on the computer, or a corrupted DNS server, redirects the user to a fake website.
- Pharming: this happens even when the user types the genuine URL, so the user does not need to click anything.
- Malware installed without the user's knowledge that monitors the user's activity, for example recording key presses.
- The recorded data (such as passwords) is sent to a third party.
- It scans files and memory (on access or on a schedule).
- It compares code with a database of known virus signatures / looks for suspicious behaviour (heuristics).
- Infected files are quarantined or deleted, and the user is alerted; the signature database is updated regularly.
- Hackers can now attempt to access the PCs from outside the business.
- Measure: a firewall between the LAN and the internet filters traffic against rules and blocks unauthorised traffic (or strong passwords / access rights).
- Malware (viruses or spyware) can arrive by email or download and spread between the PCs over the LAN.
- Measure: up-to-date anti-virus / anti-spyware software on every PC, scanning files and downloads.
- A firewall does not stop malware brought in by users, for example on a USB drive or in an email attachment.
- It does not stop an authorised user misusing their access or deleting data by mistake (access rights and backups are needed).
- It does not stop phishing / a user giving away a password, or protect data if a device is stolen (encryption needed).
- A minimum length, for example at least 12 characters.
- A mix of upper case, lower case, digits and symbols, and no dictionary words or personal details.
- The account is locked after a set number of failed attempts / passwords are changed regularly and not reused.
6 multiple-choice questions on this lesson
From the topic question bank. Assign them in the app for a marked score in your gradebook, or run the topic as a class game.
What is the key difference between phishing and pharming?
- AIn phishing the user clicks a link in a fake message; in pharming the user types the correct address but is redirected to a fake website
- BIn phishing the user is redirected by a corrupted DNS server; in pharming the user clicks a link in a fake email
- CPhishing steals data with a key logger; pharming deletes files from the user's computer
- DPhishing only happens on mobile phones; pharming only happens on desktop computers
A user's bank password was stolen, even though she only ever typed it on the genuine bank website. Which threat is most likely, and which measure would have helped?
- ASpyware recording her key presses; anti-spyware software
- BPhishing; checking the sender's address in emails
- CA virus deleting her files; a regular backup
- DPharming; a stronger password with mixed characters
How does a firewall help protect a network from hackers?
- AIt checks each packet entering or leaving the network against a set of rules and blocks those that break them
- BIt scans every file on the network and compares it with a database of virus signatures
- CIt encrypts all the data on the network so that hackers cannot understand it
- DIt makes a copy of all the network's data so it can be restored after an attack
Why must anti-virus software be updated regularly?
- ANew viruses keep appearing, and their signatures must be added to the database it compares files with
- BIts own program files become fragmented and need to be rewritten to the disk
- CThe firewall rules it uses must be changed every time the network grows
- DIt deletes its old signatures after each scan, so they must be downloaded again
A sales team carries customer data on laptops. For which risk is encryption the most suitable measure?
- AA laptop is stolen and the thief removes the hard disk to read it in another computer
- BA junior employee deletes the customer file by mistake
- CA virus spreads to the laptops from an infected email attachment
- DThe laptop's hard disk fails and the customer file cannot be read
A manager says: "We have a firewall, so our data is completely secure." Which reason best shows this is wrong?
- AA firewall cannot stop an authorised employee damaging data, or malware arriving in an email attachment the user opens
- BA firewall only works on stand-alone computers, so it does nothing on a network
- CA firewall slows the network down so much that staff will turn it off
- DA firewall blocks all traffic from the internet, so the company cannot send emails
Quiz key
Phishing relies on the user following a link in a genuine-looking message; pharming uses malicious code or a corrupted DNS server so even the correct URL leads to a fake site. The second option swaps the two. Key loggers are spyware, and neither threat is about deleting files. Neither is limited to one kind of device.
Spyware such as a key logger records what is typed and sends it to a third party; anti-spyware detects and removes it. Phishing and pharming both involve a fake website, which she never used. A virus deleting files would not reveal a password, and a backup does not stop theft. A stronger password is still captured by a key logger.
A firewall inspects incoming and outgoing traffic against rules such as allowed IP addresses and ports, blocking anything else. Comparing files with signatures is anti-virus software. Scrambling data is encryption, and copying data for restoration is a backup.
Anti-virus software compares files with known virus signatures, so new malware is missed until its signature is added. Fragmentation has nothing to do with detection. Firewall rules are separate from anti-virus software. Signatures are not deleted after a scan.
If a thief has the physical disk, passwords and firewalls can be bypassed, but encrypted data is meaningless without the key. An authorised employee deleting a file needs access rights and backups. A virus needs anti-virus software and care with attachments. A failed disk needs a backup; encryption cannot recover lost data.
A firewall filters traffic by rules; it cannot stop insiders misusing their access, malware in traffic it allows, or phishing and data loss from hardware failure. A firewall is designed to protect networks. Slowing the network is not a security weakness of the firewall itself. A firewall blocks traffic that breaks its rules, not all traffic.
What to project
The student lesson embeds these tabs. Open them full screen on the projector; every slider has a drag handle on the stage.
Slides for this lesson
A projectable deck for every pack is on the way. Until then, present the student lesson full screen: its sections, figure and lab tabs follow the same order as the plan above.