The shape of the lesson
By the end of the lesson, learners can
- Proving who you are: Authentication checks that users are who they claim to be; access levels then decide what each user may do.
- Guarding the system: These solutions work in the background, filtering traffic, scanning files and fixing weaknesses.
- Protecting the user: Many attacks rely on fooling a person, so some of the most important solutions are habits and settings.
- Network: firewall filters traffic; proxy server hides IP addresses, filters and absorbs DDoS.
- Computer: anti-malware scans and quarantines; automatic updates patch weaknesses.
- Account: passwords, biometrics, two-step verification; access levels limit what each user sees.
- User and data in transit: check spelling, tone and URLs; privacy settings; SSL encrypts.
One picture every idea returns to
Data is kept safe by several layers of protection. Firewalls and proxy servers control traffic between a network and the internet. Anti-malware (including anti-virus and anti-spyware) and automatic software updates protect each computer. Authentication (username and password, biometrics, two-step verification) and access levels control who can see what. SSL encrypts data in transit. Privacy settings, and users checking the spelling and tone of messages and the URL attached to a link, protect against people-based attacks. Exam answers must explain how a solution keeps data safe.
Forty-five minutes, phase by phase
| Time | Phase | What happens in the room | Grouping |
|---|---|---|---|
| 0 to 5 min | Hook: predict | Open with the question in the title, Layers of defence.. No single tool stops every attack. Put the figure on the board: it is the one picture every idea in the lesson returns to. | Whole class, then pairs |
| 5 to 13 min | Teach and check: Proving who you are | Authentication checks that users are who they claim to be; access levels then decide what each user may do. Project tab 5 of the lab (Password strength and threats) and let a student drive it while the class predicts. | Whole class, then pairs |
| 13 to 21 min | Teach and check: Guarding the system | These solutions work in the background, filtering traffic, scanning files and fixing weaknesses. | Pairs |
| 21 to 30 min | Teach and check: Protecting the user | Many attacks rely on fooling a person, so some of the most important solutions are habits and settings. Project tab 5 of the lab (Spot the phishing email) and let a student drive it while the class predicts. Model the worked example Match the solution on the board, one line at a time. Your turn: Which solution helps most against data interception on a payment page, and why? | Cooperative Concept Mapping |
| 30 to 36 min | Check | The four Stage 1 questions from the student lesson, answered on mini whiteboards or by show of fingers. Re-teach the one most get wrong. | Individual, then whole class |
| 36 to 43 min | Plenary | The exam-style questions from Stage 2, one at a time: thirty seconds alone, then a random call. The feedback lines in the key give the examiner's wording. | Individual, random call |
| 43 to 45 min | Exit and homework | Set the worksheet below (6 questions, 17 marks). Learners self-assess against the objectives before they leave. | Individual |
Protect the parts that carry the learning
The sequence carries about fifty minutes of material, so the lab is driven by one student while the class predicts rather than explored freely. Times are a guide.
Protected: the check at 30 minutes. It is the only individual read on whether the key idea landed, and it is not cut.
Cut first if the build overruns: the last check in Protecting the user, never the check or the plenary.
In a 60 minute block: run worksheet questions 1 to 3 in class as a Rally Coach set and model both the hardest worked example and its check live.
Cooperative Concept Mapping
Teams receive the key terms on cards and arrange them on a large sheet, drawing and labelling the links. Compare maps between teams before showing the model map.
The full structure, with its variations and the other twelve, is on the cooperative-learning page.
What to head off, and how
| Trap learners fall into | Teaching move that pre-empts it |
|---|---|
| "Use a password" is not enough for marks. | Explain how it helps: e.g. a long, complex password has so many combinations that a brute-force attack would take too long to find it. |
| A firewall does not remove malware that is already on the computer; that is the job of anti-malware. | A firewall filters traffic. |
Keeping data safe from security threats: worksheet
6 questions, 17 marks. Written in the style of the papers; no past paper question is reproduced.
Explain how a firewall helps to keep data safe.
Describe two methods of authentication, other than a username and password.
A company is worried about phishing emails. Describe two checks employees should make before clicking a link in an email, and explain why each helps.
Explain how access levels help to keep data safe in a school's computer system.
For each threat, identify the most suitable solution and explain how it helps: (a) ransomware arriving in an email attachment; (b) data interception on an online payment page.
Explain why software updates should be automated.
Answer key and marking notes
- A firewall monitors the traffic coming into and going out of a computer / network.
- It checks the traffic against a set of rules / criteria (e.g. blacklisted IP addresses).
- Traffic that does not meet the rules is blocked, preventing hacking / malware getting in.
- Biometrics: a unique physical feature, such as a fingerprint or face, is scanned and compared with stored data.
- Two-step verification: a one-time code is sent to the user's phone / email and must be entered as well as the password.
- Check the spelling and tone of the email, e.g. spelling mistakes, generic greetings or urgent, threatening language.
- These are signs the email is not from a genuine organisation, so the link should not be clicked.
- Check the URL attached to the link (hover over it) before clicking.
- A misspelt or unexpected domain shows the link leads to a fake website.
- Different users are given different permissions, e.g. students can read but not change records, teachers can edit marks.
- So users (or a hacker using one account) can only access or change the data they are allowed to, protecting the rest.
- (a) Anti-malware (anti-virus).
- It scans the attachment, compares it with known malware signatures and quarantines / deletes it before it can run.
- (b) SSL (HTTPS).
- It encrypts the payment data, so if it is intercepted it cannot be understood.
- Updates contain patches that fix security weaknesses / bugs that attackers could exploit (and update malware definitions).
- Automating them means they are installed as soon as they are released, without relying on the user remembering.
6 multiple-choice questions on this lesson
From the topic question bank. Assign them in the app for a marked score in your gradebook, or run the topic as a class game.
How does a firewall help to keep data safe?
- AIt monitors traffic in and out of a network and blocks traffic that breaks set rules
- BIt scans files on the hard drive and deletes any malware it finds
- CIt encrypts data so that intercepted data cannot be understood
- DIt checks the spelling of emails to detect phishing
After entering her password, a student must also type a six-digit code sent to her phone before she can log in. How does this keep her account safe?
- ASomeone who has stolen her password still cannot log in without her phone
- BHer password is encrypted twice before it is sent
- CThe code replaces her password, so the password is never needed
- DHer account is locked after two wrong attempts
An email claiming to be from Northway Bank says: "Dear valued custommer, verify your acount within 2 hours or it will be closed." Hovering over the link shows www.n0rthway-verify.net. Which checks reveal that it is a phishing email?
- AChecking the spelling and tone of the email, and checking the URL attached to the link
- BChecking that the firewall is switched on, and checking the access levels
- CChecking the privacy settings, and checking that anti-malware is up to date
- DChecking that the email arrived over HTTPS, and checking its timestamp
Which solution best protects card details from data interception while they are sent to an online shop?
- ASSL, because it encrypts the data in transit
- BA firewall, because it blocks all traffic to the shop
- CAccess levels, because they limit which staff can see records
- DPrivacy settings, because they hide the user's posts
Which threat is correctly matched with the most suitable solution?
- ARansomware in an email attachment: anti-malware that scans and quarantines the file
- BBrute-force attack on a login: SSL encryption of the web page
- CPharming by code on the user's computer: a longer password
- DData interception on public Wi-Fi: checking the spelling of emails
A hacker steals a student's password for a school's computer system and logs in. Which solution, already in place, would most limit the data the hacker can reach?
- AAccess levels, because the account can only read the data a student is permitted to see
- BA proxy server, because it hides the student's IP address from websites
- CAutomatic software updates, because they patch weaknesses in the operating system
- DBiometrics, because a fingerprint is needed to open each file
Quiz key
A firewall filters incoming and outgoing traffic against rules, for example blocking blacklisted IP addresses. Removing malware already on the computer is the job of anti-malware, encrypting data in transit is done by SSL, and checking spelling is something the user does.
With two-step verification a stolen password alone is not enough, because the attacker also needs the one-time code sent to the user's own device. The code does not encrypt the password, it is used as well as the password (not instead of it), and locking an account after failed attempts is a different measure.
The misspellings (custommer, acount), the generic greeting and the urgent threat show the tone and spelling of a phishing email, and the link uses a zero in place of the letter o on an unexpected domain. Firewalls, access levels, privacy settings and anti-malware are useful protections, but none of them is the check that reveals this message is fake, and neither HTTPS nor a timestamp shows whether the sender is genuine.
SSL (used by HTTPS) encrypts data between the browser and the web server, so intercepted card details cannot be understood. A firewall filters traffic but does not encrypt it, and blocking all traffic would stop the purchase. Access levels and privacy settings protect stored data and personal information, not data in transit.
Anti-malware compares the attachment with known malware signatures and quarantines it before it can encrypt any files. SSL protects data in transit but does not stop password guessing (strong passwords, lockouts and two-step verification do). A longer password does nothing against redirection code; anti-malware does. Checking spelling helps against phishing, not interception, which needs encryption such as SSL.
Access levels give each account only the permissions it needs, so a student account cannot change marks or open staff records, limiting the damage. A proxy server hides IP addresses and filters traffic but does not restrict what a logged-in account can see. Updates close software weaknesses but do not restrict a valid account. Biometrics are a way of logging in, not a control on individual files, and this hacker has already logged in with the password.
What to project
The student lesson embeds these tabs. Open them full screen on the projector; every slider has a drag handle on the stage.
Slides for this lesson
A projectable deck for every pack is on the way. Until then, present the student lesson full screen: its sections, figure and lab tabs follow the same order as the plan above.