Computer Science - ICT Grade 10 Cybersecurity Threats Attacks Defence

Grade 10 Computer Science – ICT
Topic: Cybersecurity: Threats, Attacks, Defense

1. The Driving Question

"If your phone is just a slab of glass and metal, how can someone on the other side of the world steal your bank password, lock your files for ransom, or turn your laptop into a weapon—without ever touching it? And why isn’t there just one ‘antivirus’ that fixes everything?"

2. The Core Idea – Built, Not Listed

Imagine your school’s Wi-Fi network is like a busy hallway between classrooms. Normally, students (data packets) move freely, but what if someone dressed like a teacher (a hacker) slips in unnoticed? They could: - Eavesdrop (sniffing traffic) to hear private conversations (like passwords).
- Impersonate (phishing) a trusted friend to trick you into opening a locked door (malware).
- Block the hallway (DDoS) with too many people (fake requests) so no one can get through.

Cybersecurity is the set of locks, ID checks, and emergency plans that keep the hallway safe—not just from one threat, but from all the creative ways attackers exploit weak spots.

Key Vocabulary:
1. Malware
- Definition: Malicious software designed to damage, disrupt, or gain unauthorized access to a system.
- Example: A "free" PDF converter that secretly installs a keylogger to record every keystroke (including passwords) on your cousin’s gaming PC.
- College Shift: In advanced cybersecurity, malware is classified by behavior (e.g., ransomware vs. spyware) and analyzed at the assembly-code level to trace its origin.

1. Phishing
2. Definition: A social engineering attack where an attacker masquerades as a trusted entity to trick victims into revealing sensitive information.
3. Example: A fake "Netflix subscription expired" email with a link to a login page that looks identical to the real one—but the URL is netfl1x-billing.com.

4. College Shift: Phishing evolves into spear-phishing (targeted attacks) and whaling (CEO fraud), where attackers research victims’ personal lives to craft convincing lies.

5. Firewall

6. Definition: A network security system that monitors and controls incoming/outgoing traffic based on predetermined security rules.
7. Example: Your home router’s firewall blocks unsolicited requests from the internet (like a stranger knocking on your door) but allows responses to your requests (like ordering pizza).

8. College Shift: Firewalls become next-generation firewalls (NGFW) that inspect the content of traffic (e.g., blocking a file named "invoice.exe" if it contains malware).

9. Zero-Day Exploit

10. Definition: An attack that targets a previously unknown vulnerability in software, giving developers zero days to fix it.
11. Example: A hacker discovers a flaw in a popular video game’s multiplayer code that lets them crash other players’ computers—before the game’s creators even know the flaw exists.
12. College Shift: Zero-days are traded on the dark web for millions of dollars, and governments stockpile them for cyber warfare.

3. Assessment Translation

Grade 10 State Standardized Test (e.g., ISTE, Common Core ICT Literacy):
- Format: Mix of multiple-choice, short-answer, and scenario-based questions (e.g., "Explain how a firewall could prevent a DDoS attack on a school network").
- Distractor Patterns:
- Misidentifying threats: Confusing phishing (tricking a user) with malware (infecting a system).
- Overgeneralizing defenses: Assuming a firewall stops all attacks (it doesn’t protect against phishing or insider threats).
- Ignoring human factors: Forgetting that the weakest link in cybersecurity is often people (e.g., reusing passwords).

Proficient vs. Developing Responses:
| Question: "A friend receives an email from ‘Amazon’ asking them to ‘verify their account’ by clicking a link. What type of attack is this, and how should they respond?" | |----------------------------------------------------------------------------------------------------------------------------------------------------------------| | Developing: "It’s a virus. They should delete it." (Lacks specificity; doesn’t explain why the link is dangerous.) | | Proficient: "This is a phishing attack. The email is trying to trick them into entering their Amazon password on a fake website. They should: 1) Check the sender’s email address (e.g., @amazon-security.com vs. @amazon.com), 2) Hover over the link to see the real URL, and 3) Report the email to Amazon’s official phishing team." (Identifies the attack, explains the risk, and provides actionable steps.) |

Model Proficient Response (Scenario-Based):
Prompt: "Your school’s website crashes during finals week. The IT team suspects a cyberattack. Describe two possible types of attacks that could cause this, and explain how the school could defend against them in the future."

"One possible attack is a DDoS (Distributed Denial of Service), where hackers flood the school’s server with fake traffic until it crashes. Another could be ransomware, where malware encrypts the school’s files and demands payment to unlock them. To defend against DDoS, the school could use a firewall with rate-limiting or a content delivery network (CDN) to absorb traffic spikes. For ransomware, they should back up files regularly and train staff to avoid suspicious email attachments. Both attacks exploit weak points—DDoS targets availability, while ransomware targets data integrity—so defenses need to be layered."

4. Mistake Taxonomy

Mistake 1: Confusing Threats with Attacks
- Question: "Which of the following is an example of malware? A) A pop-up ad B) A fake login page C) A keylogger D) A slow computer" - Common Wrong Answer: A) A pop-up ad (Students assume all annoying things are malware.) - Why It Loses Credit: Pop-ups are annoying but not necessarily malicious. Malware damages or steals—a keylogger (C) records passwords, while a fake login page (B) is phishing.
- Correct Approach: Malware is software (e.g., viruses, worms, ransomware). Phishing is trickery. A slow computer could be malware or just a hardware issue—context matters.

Mistake 2: Assuming Technology Alone Solves Everything
- Question: "A company’s database is hacked, exposing customer passwords. What is the most effective way to prevent this in the future?" - Common Wrong Answer: "Install a stronger firewall." (Students over-rely on tech fixes.) - Why It Loses Credit: Firewalls block network attacks, but if hackers steal passwords via phishing or insider threats, a firewall won’t help. The question asks for the most effective solution.
- Correct Approach: Multi-factor authentication (MFA) + employee training + firewall. MFA stops stolen passwords from being used, training reduces phishing success, and a firewall blocks brute-force attacks.

Mistake 3: Ignoring the "Why" in Defense Strategies
- Question: "Explain why backing up files is an important defense against ransomware." - Common Wrong Answer: "Because it saves your files." (Too vague; doesn’t explain the mechanism.) - Why It Loses Credit: The question tests understanding, not memorization. A good answer explains how backups defeat ransomware’s leverage.
- Correct Approach: Ransomware encrypts files and demands payment to unlock them. Backups let you restore files without paying, removing the hacker’s power. Cloud backups (e.g., Google Drive) are safer than local ones, which ransomware can also encrypt.

5. Connection Layer

1. Within Computer Science:
   [Cybersecurity] → [Encryption] — Understanding threats like man-in-the-middle attacks makes it clear why we need HTTPS (not just HTTP) to encrypt data in transit. Without encryption, even a strong firewall can’t protect data after it leaves your device.

2. Across Subjects:
   [Cybersecurity] → [Psychology (Social Engineering)] — Phishing and scams work because they exploit cognitive biases (e.g., urgency, authority). A cybersecurity expert needs to know how people think to design better defenses (e.g., why "Your account will be deleted in 24 hours!" emails trick so many people).

3. Outside School:
   [Cybersecurity] → [Smart Home Devices] — Your family’s "smart" thermostat or doorbell might be part of a botnet (a network of hacked devices) used in DDoS attacks—without you even knowing. Suddenly, "Why does my Wi-Fi keep disconnecting?" becomes a cybersecurity question.

6. The Stretch Question

"If a hacker can break into a nuclear power plant’s systems (like in the 2010 Stuxnet attack), why don’t we just disconnect all critical infrastructure from the internet? What’s the trade-off?"

Pointer Toward the Answer:
Disconnecting (air-gapping) works—but it also cuts off remote monitoring (e.g., engineers fixing problems from afar) and software updates (which patch vulnerabilities). The trade-off is between security and functionality. Stuxnet spread via USB drives, proving that even air-gapped systems aren’t foolproof. The real question is: How much inconvenience are we willing to accept for safety? (This is why banks use MFA instead of banning online banking entirely.)