The shape of the lesson
By the end of the lesson, learners can
- Getting in: These three threats are about getting at data without permission.
- Flooding and malware: A DDoS attack stops a service working; malware is software written to cause harm.
- Tricking people: These attacks aim at the user rather than the hardware.
- Process: describe how the attack is carried out, step by step.
- Aim: say what the attacker wants: data, access, money or disruption.
- Malware: virus, worm, Trojan horse, spyware, adware, ransomware: know the difference.
- Phishing vs pharming: a link in a message, versus redirection by malicious code.
One picture every idea returns to
A cyber security threat is any attempt to damage, steal or gain unauthorised access to data or computer systems. For every threat, an exam answer needs the process (how the attack is carried out) and the aim (what the attacker wants). Some threats attack the technology: brute-force attacks, data interception, DDoS attacks, hacking and malware. Others attack people or redirect them: phishing, pharming and social engineering.
Forty-five minutes, phase by phase
| Time | Phase | What happens in the room | Grouping |
|---|---|---|---|
| 0 to 5 min | Hook: predict | Open with the question in the title, Know your attacker.. Some attacks target computers: guessing passwords, flooding servers, planting malware. Put the figure on the board: it is the one picture every idea in the lesson returns to. | Whole class, then pairs |
| 5 to 13 min | Teach and check: Getting in | These three threats are about getting at data without permission. Project tab 5 of the lab (Cyber security threats) and let a student drive it while the class predicts. Model the worked example Brute-force arithmetic on the board, one line at a time. | Whole class, then pairs |
| 13 to 21 min | Teach and check: Flooding and malware | A DDoS attack stops a service working; malware is software written to cause harm. | Pairs |
| 21 to 30 min | Teach and check: Tricking people | These attacks aim at the user rather than the hardware. Project tab 5 of the lab (Spot the phishing email) and let a student drive it while the class predicts. | Anticipation / Reaction Guide |
| 30 to 36 min | Check | The four Stage 1 questions from the student lesson, answered on mini whiteboards or by show of fingers. Re-teach the one most get wrong. | Individual, then whole class |
| 36 to 43 min | Plenary | The exam-style questions from Stage 2, one at a time: thirty seconds alone, then a random call. The feedback lines in the key give the examiner's wording. | Individual, random call |
| 43 to 45 min | Exit and homework | Set the worksheet below (6 questions, 17 marks). Learners self-assess against the objectives before they leave. | Individual |
Protect the parts that carry the learning
The sequence carries about fifty minutes of material, so the lab is driven by one student while the class predicts rather than explored freely. Times are a guide.
Protected: the check at 30 minutes. It is the only individual read on whether the key idea landed, and it is not cut.
Cut first if the build overruns: the last check in Tricking people, never the check or the plenary.
In a 60 minute block: run worksheet questions 1 to 3 in class as a Rally Coach set and model both the hardest worked example and its check live.
Anticipation / Reaction Guide
Before the lesson, students mark five statements true or false. After the teaching they mark them again and justify any change of mind in one sentence each. The statements come from the examiner traps below.
The full structure, with its variations and the other twelve, is on the cooperative-learning page.
What to head off, and how
| Trap learners fall into | Teaching move that pre-empts it |
|---|---|
| "Hacking is when someone gets your data" is too vague. | Say unauthorised access to a computer system, and give an aim such as stealing or deleting data. |
| A virus needs a host file and is spread when that file is run; a worm is standalone and spreads itself across networks. | Do not use "virus" as the word for all malware. |
| Phishing needs the user to click a link in a message. | Pharming needs no click: the user types the right address and is still redirected by malicious code. |
Cyber security threats: worksheet
6 questions, 17 marks. Written in the style of the papers; no past paper question is reproduced.
Describe the process and the aim of a distributed denial of service (DDoS) attack.
Explain the difference between phishing and pharming.
Describe what is meant by ransomware.
Explain how a worm differs from a virus.
A PIN is made of 4 digits, each 0 to 9. A brute-force program tries 50 PINs per second. Calculate the maximum time needed to try every PIN.
An employee receives a phone call from someone claiming to be from the company's IT department, who asks for the employee's password to fix a problem. Identify the threat and describe its process and aim.
Answer key and marking notes
- Many computers are infected with malware to form a botnet.
- They are all made to send large numbers of requests to a web server at the same time, so it is overloaded.
- Aim: the server cannot respond to genuine users, so the website / service is unavailable.
- Phishing: the user is sent an email / message that appears to come from a trusted source.
- It contains a link to a fake website where the user enters personal details.
- Pharming: malicious code is installed on the user's computer or a DNS server.
- It redirects the user to a fake website even when they type the correct URL (no link has to be clicked).
- Malware that encrypts the user's files / locks the computer.
- So the user cannot access their data.
- The attacker demands payment in return for the decryption key.
- A virus attaches to a host file / program and needs that file to be run (user action) to replicate.
- A worm is a standalone program that replicates and spreads across a network by itself, without user action.
- There are 104 = 10 000 possible PINs.
- 10 000 ÷ 50 = 200 seconds (3 minutes 20 seconds).
- Social engineering.
- Process: the attacker manipulates / deceives a person by pretending to be someone trusted, so the person breaks security procedures.
- Aim: to obtain confidential information (the password) and gain unauthorised access to the system.
6 multiple-choice questions on this lesson
From the topic question bank. Assign them in the app for a marked score in your gradebook, or run the topic as a class game.
Which describes the process of a distributed denial of service (DDoS) attack?
- AMany infected computers in a botnet send huge numbers of requests to one server at the same time
- BSoftware tries every possible password until the correct one is found
- CA packet sniffer reads data as it travels across a network
- DMalicious code redirects users to a fake website when they type a correct URL
A user receives an email that appears to be from their bank. It asks them to click a link and confirm their login details on a website that looks like the bank's. What is this threat?
- APhishing
- BPharming
- CA brute-force attack
- DAdware
A door lock uses a PIN of 4 digits, each from 0 to 9. A brute-force device tries 20 PINs every second. What is the longest it could take to try every possible PIN?
- A500 seconds
- B2 seconds
- C200 000 seconds
- D50 seconds
Which type of malware is a standalone program that replicates itself and spreads across a network without any user action?
- AWorm
- BVirus
- CTrojan horse
- DRansomware
A password is 5 characters long. Each character is a lowercase letter (a to z) or a digit (0 to 9). Software tries 1 000 000 passwords per second. What is the longest a brute-force attack could take, to the nearest second?
- A60 seconds
- B12 seconds
- C1008 seconds
- DLess than a millisecond
A user types the correct address of their bank into the browser, but is taken to a fake copy of the bank's website. No email or link was involved. Which threat is this, and how was it carried out?
- APharming: malicious code on the computer or a DNS server redirected the request
- BPhishing: the user was sent a link to the fake website in an email
- CData interception: a packet sniffer copied the bank's web page
- DA Trojan horse: the bank's website was disguised as a game
Quiz key
In a DDoS attack the attacker uses a botnet of infected computers to flood one server with requests, so it cannot respond to genuine users. Trying every password is a brute-force attack, reading data in transit is data interception, and redirecting users to a fake site after they type a correct URL is pharming.
Phishing sends a message that appears to come from a trusted organisation, with a link to a fake website where the user enters personal details. Pharming redirects the user without any link being clicked. A brute-force attack guesses passwords, and adware displays unwanted adverts.
There are 10 × 10 × 10 × 10 = 10 000 possible PINs, and 10 000 ÷ 20 = 500 seconds (8 minutes 20 seconds). 2 seconds comes from adding 10 × 4 = 40 combinations instead of multiplying. 200 000 seconds comes from multiplying by the rate instead of dividing. 50 seconds uses only 1000 combinations (3 digits).
A worm is standalone and spreads itself across networks. A virus attaches to another file and spreads when that file is run. A Trojan horse is disguised as legitimate software that the user installs, and ransomware encrypts files and demands payment.
Each position has 36 possibilities, so there are 365 = 60 466 176 passwords; 60 466 176 ÷ 1 000 000 ≈ 60 seconds. 12 seconds uses only the 26 letters (265 = 11 881 376). 1008 seconds divides by 1000 instead of 1 000 000. Less than a millisecond comes from multiplying 36 × 5 = 180 combinations instead of raising 36 to the power 5.
Pharming redirects the user to a fake site even when the correct URL is typed, using malicious code on the user's computer or on a DNS server. Phishing needs the user to click a link in a message, which did not happen here. Data interception reads data in transit but does not redirect the user. A Trojan horse is malware disguised as useful software, not a disguised website.
What to project
The student lesson embeds these tabs. Open them full screen on the projector; every slider has a drag handle on the stage.
Slides for this lesson
A projectable deck for every pack is on the way. Until then, present the student lesson full screen: its sections, figure and lab tabs follow the same order as the plan above.