Homeschool Guide: These lesson plans are a guide for parents. Content may contain errors — always cross-reference with official exam board specifications.

cyber security threats

FoundationHigherAll Boards

4 detailed 50-minute lessons with teaching scripts, worked examples, parent guides, and assessment criteria.

Fastmail

Lesson Overview

Total Lessons: 4
Tier: Foundation and Higher
Duration: 50 minutes per lesson (200 minutes total)
Exam Boards: AQA, Edexcel, OCR, Eduqas, CCEA

Learning Objectives

Prerequisites

Materials & Equipment

Lesson 1: Introduction: cyber security threats

Duration: 50 minutes

Starter Activity (5 minutes)

Quick Recall

Write down everything you already know about cyber security threats. Then check against the key terms: Key Concept, GCSE Computer Science Exam Tips. Use a mini-whiteboard or paper.

Main Content (35 minutes)

Parent/Teacher Guide:
Before lesson: Read the script below. Pre-teach key vocab: Key Concept, GCSE Computer Science Exam Tips.
If stuck: Re-read the revision notes (link above), then break the content into smaller steps.
Extension: See the Stretch & Challenge ideas in Lesson 4.
Teaching Script (35 mins):
Mins 0-5 - Hook: "Today: cyber security threats. By the end you will be able to answer exam questions on it unaided. It connects to the rest of Computer Science because the ideas here recur across the spec."
Mins 5-20 - Direct Instruction: Work through the core ideas below one at a time; after each, ask your student to explain it back in their own words.
Mins 20-30 - Guided Practice: Model the worked example together, then let your student attempt the first practice question with guidance.
Mins 30-35 - Independent Practice: 2-3 practice questions from Lesson 3 below, with immediate feedback.
First Look

Start with the revision notes summary, then attempt: Explain the difference between phishing and pharming.

Plenary (5 minutes)

Check Out

Your student states one thing they learned and one question they still have about cyber security threats.

Lesson 2: Core Concepts: cyber security threats

Duration: 50 minutes

Starter Activity (5 minutes)

Review Previous Lesson

Quick recap: write 3 key points from Lesson 1 on cyber security threats. Check them against the notes below.

Main Content (35 minutes)

Definition: Social engineering is manipulating people into revealing confidential information or performing actions that compromise security. It exploits human psychology rather than technical vulnerabilities.
Definition: Blagging is inventing a false scenario (pretext) to trick someone into revealing information. The attacker creates a convincing story to gain the victim's trust.
Definition: Phishing is sending fraudulent emails that appear to come from a trusted source, designed to trick recipients into revealing personal information, clicking malicious links, or downloading malware.
Definition: Shouldering is directly observing someone's screen or keyboard to obtain personal information, such as passwords or PIN numbers, by looking over their shoulder.
Definition: Malware (malicious software) is any software deliberately designed to cause damage to a computer, server, client, or network. Different types of malware have different purposes and methods.
Definition: Pharming redirects users to a fake website even when they type the correct URL. It manipulates the DNS (Domain Name System) so that the legitimate web address points to the attacker's server.
TermMeaningExample
VirusAttached to host filesDamage, corruption
TrojanDisguised as legitimate softwareBackdoor access, data theft
SpywareBundled with other softwareMonitoring, data collection
RansomwareEmail attachments, exploitsExtortion (encrypt files for ransom)
Confusing virus and TrojanViruses replicate; Trojans don'tVirus = replicates via host file; Trojan = disguised software
Confusing phishing and pharmingPhishing tricks via email; pharming redirects URLsPhishing = fake email; Pharming = fake website redirect
Saying "social engineering is a technical attack"It targets people, not technologySocial engineering exploits human psychology
Forgetting to mention how threats combineReal attacks often use multiple methodsExplain how phishing can lead to malware, etc.

Practice (10 minutes)

Q: Explain the difference between phishing and pharming.

Answer: Phishing sends fraudulent emails that appear to be from a trusted source, tricking users into clicking links to fake websites or revealing information. Pharming manipulates DNS so that even when the user types the correct URL, they are redirected to a fake website. Phishing requires the victim to click a link; pharming redirects automatically.

Plenary (5 minutes)

Explain Back

Your student teaches the key points back to you without looking. Fill any gaps immediately.

Lesson 3: Application: cyber security threats

Duration: 50 minutes

Starter Activity (5 minutes)

Quick Recall

Recall the key terms: Key Concept, GCSE Computer Science Exam Tips. Define each in one sentence.

Main Content (35 minutes)

Parent/Teacher Guide: Let your student attempt each question alone first, then compare with the model answer. Award method marks for correct working even if the final answer is wrong.

Q1: Explain the difference between phishing and pharming.

Answer: Phishing sends fraudulent emails that appear to be from a trusted source, tricking users into clicking links to fake websites or revealing information. Pharming manipulates DNS so that even when the user types the correct URL, they are redirected to a fake website. Phishing requires the victim to click a link; pharming redirects automatically.

Q2: Describe four types of malware and how each one works.

Answer: Virus: attaches to a host file, replicates when the file is opened, can corrupt or delete data. Trojan: disguised as legitimate software, does not replicate, creates backdoors for attackers. Spyware: secretly monitors user activity, records keystrokes and sends data to attacker. Ransomware: encrypts files and demands payment for decryption.

Q3: What is social engineering? Describe blagging, phishing, and shouldering.

Answer: Social engineering manipulates people into revealing information or performing actions that compromise security. Blagging: inventing a false scenario to gain trust and extract information (e.g. pretending to be IT support). Phishing: sending fraudulent emails appearing to be from trusted sources. Shouldering: directly observing someone's screen or keyboard to capture passwords or data.

Q4: Why are weak and default passwords a security threat?

Answer: Weak passwords (like 123456) can be easily guessed or cracked using brute force or dictionary attacks. Default passwords on devices are publicly known and can be found online, so any attacker can access a device if the default password hasn't been changed.

Q5: Explain how multiple cyber security threats could combine in a single attack.

Answer: A phishing email (social engineering) tricks a user into opening an attachment that installs a Trojan. The Trojan exploits unpatched software to gain elevated access. Because of misconfigured access rights, the malware spreads across the network. The attacker then installs ransomware to encrypt files and demand payment. This combines social engineering + malware + unpatched software + misconfigured access + ransomware.

Plenary (5 minutes)

Error Review

Review any questions answered incorrectly. Identify whether the error was knowledge, method, or reading the question.

Lesson 4: Exam Practice: cyber security threats

Duration: 50 minutes

Starter Activity (5 minutes)

Command Words

Review what these command words require: state (one point), describe (say what happens), explain (say why), compare (both sides), evaluate (judgement).

Main Content (35 minutes)

Exam-Style Question

Attempt a past-paper style question on cyber security threats from the exam board past paper finder (see Resources), then mark it against the scheme.

Exam Tips: Know each social engineering technique with specific examples | Distinguish clearly between virus, Trojan, spyware, and ransomware | Phishing = email; Pharming = URL redirect (know the difference) | Always explain that social engineering targets PEOPLE, not technology | Be prepared to explain how multiple threats combine in an attack | Use specific, realistic examples rather than vague descriptions
Common Errors: ✗ Thinking phishing only happens via email ✓ Phishing can occur via email, text messages (smishing), phone calls (vishing), or fake websites. Any method of tricking users into revealing personal information is phishing. ✗ Confusing viruses and worms ✓ A virus attaches to a file and needs user action to spread. A worm is self-replicating and spreads automatically across networks without user intervention. ✗ Believing social engineering is a technical attack ✓ Social engineering manipulates people, not systems. It exploits human psychology (trust, urgency, authority) to gain information or access — no software vulnerability is needed. ✗ Thinking strong passwords alone prevent all unauthorised
Stretch & Challenge (Grade 8-9):
  • Synoptic links: explain how cyber security threats connects to another Computer Science topic you have studied
  • Real-world: research one real-world use or example of cyber security threats
  • Critical: "What are the limitations of the models used in cyber security threats?"

Plenary (5 minutes)

Assessment Criteria
  • Got it: Confident explanation + correct worked examples
  • Getting there: Main points OK, needs support with detail
  • Not yet: Confused on key concepts - re-run Lesson 2

Homework & Consolidation

Recommended Resources

🎓 Smart Lesson (Guided)