detecting & preventing cyber threats
4 detailed 50-minute lessons with teaching scripts, worked examples, parent guides, and assessment criteria.
Lesson Overview
Total Lessons: 4
Tier: Foundation and Higher
Duration: 50 minutes per lesson (200 minutes total)
Exam Boards: AQA, Edexcel, OCR, Eduqas, CCEA
Tier: Foundation and Higher
Duration: 50 minutes per lesson (200 minutes total)
Exam Boards: AQA, Edexcel, OCR, Eduqas, CCEA
Learning Objectives
- Explain the key ideas of detecting & preventing cyber threats
- Apply detecting & preventing cyber threats to exam-style questions
- Develop independent study skills
- Build cross-topic connections
Prerequisites
- Read the revision notes for detecting & preventing cyber threats first (GCSE Revise summary)
- Key vocab to pre-teach: Key Concept, Why biometrics are strong, Password Best Practices
- Basic skills: reading the summary notes and answering the practice questions there
Materials & Equipment
- Exercise book, coloured pens
- Ruler
- Printed revision notes (link below)
- Internet for videos (see Resources)
Lesson 1: Introduction: detecting & preventing cyber threats
Duration: 50 minutes
Starter Activity (5 minutes)
Quick Recall
Write down everything you already know about detecting & preventing cyber threats. Then check against the key terms: Key Concept, Why biometrics are strong, Password Best Practices. Use a mini-whiteboard or paper.
Main Content (35 minutes)
Parent/Teacher Guide:
Before lesson: Read the script below. Pre-teach key vocab: Key Concept, Why biometrics are strong, Password Best Practices.
If stuck: Re-read the revision notes (link above), then break the content into smaller steps.
Extension: See the Stretch & Challenge ideas in Lesson 4.
Before lesson: Read the script below. Pre-teach key vocab: Key Concept, Why biometrics are strong, Password Best Practices.
If stuck: Re-read the revision notes (link above), then break the content into smaller steps.
Extension: See the Stretch & Challenge ideas in Lesson 4.
Teaching Script (35 mins):
Mins 0-5 - Hook: "Today: detecting & preventing cyber threats. By the end you will be able to answer exam questions on it unaided. It connects to the rest of Computer Science because the ideas here recur across the spec."
Mins 5-20 - Direct Instruction: Work through the core ideas below one at a time; after each, ask your student to explain it back in their own words.
Mins 20-30 - Guided Practice: Model the worked example together, then let your student attempt the first practice question with guidance.
Mins 30-35 - Independent Practice: 2-3 practice questions from Lesson 3 below, with immediate feedback.
Mins 0-5 - Hook: "Today: detecting & preventing cyber threats. By the end you will be able to answer exam questions on it unaided. It connects to the rest of Computer Science because the ideas here recur across the spec."
Mins 5-20 - Direct Instruction: Work through the core ideas below one at a time; after each, ask your student to explain it back in their own words.
Mins 20-30 - Guided Practice: Model the worked example together, then let your student attempt the first practice question with guidance.
Mins 30-35 - Independent Practice: 2-3 practice questions from Lesson 3 below, with immediate feedback.
First Look
Start with the revision notes summary, then attempt: Describe two biometric security measures and explain their advantages over passwords.
Plenary (5 minutes)
Check Out
Your student states one thing they learned and one question they still have about detecting & preventing cyber threats.
Lesson 2: Core Concepts: detecting & preventing cyber threats
Duration: 50 minutes
Starter Activity (5 minutes)
Review Previous Lesson
Quick recap: write 3 key points from Lesson 1 on detecting & preventing cyber threats. Check them against the notes below.
Main Content (35 minutes)
Key Concept: Effective cyber security requires both detection (identifying threats) and prevention (stopping threats). No single method is sufficient - multiple layers of defence are needed.
Definition: Biometric security uses unique biological characteristics to identify and authenticate users. Biometrics are very difficult to forge or steal.
Why biometrics are strong: They are something you ARE, not something you KNOW (password) or HAVE (token). You cannot forget, lose, or easily share a biometric. However, if biometric data is stolen, it cannot be changed like a password can.
Definition: A password policy is a set of rules that govern how passwords are created, used, and managed within an organisation. Strong password policies significantly reduce the risk of unauthorised access.
Password Best Practices: Use different passwords for each account. Use a password manager to store complex passwords securely. Never share passwords. Never write passwords on sticky notes. Enable two-factor authentication wherever possible.
Definition: CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge designed to determine whether the user is a human or a computer (bot). It prevents automated programs from abusing online services.
| Term | Meaning | Example |
|---|---|---|
| Fingerprint | Scans unique ridge patterns on fingertips | Quick, reliable, widely available |
| Facial recognition | Maps facial features and proportions | Contactless, convenient |
| Iris/retina | Scans unique patterns in the eye | Extremely accurate, very hard to fake |
| Voice recognition | Analyses unique vocal characteristics | Can be used over phone, convenient |
| Technical | Firewalls, encryption, anti-malware, access controls, automatic updates | Network attacks, malware, data interception |
| Physical | Locked doors, CCTV, security guards, biometric building access | Physical theft, unauthorised access, shoulder surfing |
| Procedural | Security policies, staff training, password policies, pen testing | Social engineering, weak passwords, insider threats |
| Saying "anti-malware stops all threats" | It cannot detect zero-day or very new malware | Anti-malware is one layer, not complete protection |
Practice (10 minutes)
Q: Describe two biometric security measures and explain their advantages over passwords.
Answer: Fingerprint scanning: reads unique ridge patterns on fingertips. Facial recognition: maps facial features. Advantages over passwords: cannot be forgotten, lost, or easily shared; very difficult to forge; the user always has their biometric with them.
Plenary (5 minutes)
Explain Back
Your student teaches the key points back to you without looking. Fill any gaps immediately.
Lesson 3: Application: detecting & preventing cyber threats
Duration: 50 minutes
Starter Activity (5 minutes)
Quick Recall
Recall the key terms: Key Concept, Why biometrics are strong, Password Best Practices. Define each in one sentence.
Main Content (35 minutes)
Parent/Teacher Guide: Let your student attempt each question alone first, then compare with the model answer. Award method marks for correct working even if the final answer is wrong.
Q1: Describe two biometric security measures and explain their advantages over passwords.
Answer: Fingerprint scanning: reads unique ridge patterns on fingertips. Facial recognition: maps facial features. Advantages over passwords: cannot be forgotten, lost, or easily shared; very difficult to forge; the user always has their biometric with them.
Q2: What is the purpose of CAPTCHA? Give an example of how it works.
Answer: CAPTCHA determines whether the user is human or a computer program (bot). It prevents automated attacks like fake account creation, brute force attacks, and ticket scalping. Example: asking the user to select all images containing traffic lights - easy for humans, difficult for bots.
Q3: Explain how anti-malware software detects threats, including its limitations.
Answer: Anti-malware detects threats using: signature-based detection (comparing files to known malware patterns), heuristic analysis (monitoring behaviour for suspicious activity), and real-time scanning of files as they are accessed. Limitations: cannot detect brand new malware not in the signature database (zero-day), requires regular updates, can be bypassed by sophisticated threats, and does not protect against social engineering.
Q4: What is penetration testing and why is it important?
Answer: Penetration testing is an authorised simulated cyber attack performed by ethical hackers to identify security vulnerabilities before real attackers can exploit them. It is important because it finds weaknesses that can then be fixed proactively, tests both technical and human defences, and provides a realistic assessment of security posture.
Q5: Explain the principle of defence in depth, giving examples of technical, physical, and procedural measures.
Answer: Defence in depth uses multiple layers of security so that if one layer fails, others still provide protection. Technical measures: firewalls, encryption, anti-malware, automatic updates. Physical measures: locked doors, CCTV, biometric building access. Procedural measures: security policies, staff training, password policies, pen testing. No single measure is sufficient; the combination of all three types provides robust security.
Plenary (5 minutes)
Error Review
Review any questions answered incorrectly. Identify whether the error was knowledge, method, or reading the question.
Lesson 4: Exam Practice: detecting & preventing cyber threats
Duration: 50 minutes
Starter Activity (5 minutes)
Command Words
Review what these command words require: state (one point), describe (say what happens), explain (say why), compare (both sides), evaluate (judgement).
Main Content (35 minutes)
Exam-Style Question
Attempt a past-paper style question on detecting & preventing cyber threats from the exam board past paper finder (see Resources), then mark it against the scheme.
Exam Tips: Know all detection and prevention methods with how they work | Be able to explain biometrics as "something you ARE" vs passwords "something you KNOW" | CAPTCHA = human vs bot test, NOT authentication | Anti-malware: know both how it works AND its limitations | Defence in depth: always mention technical, physical, AND procedural | When asked "how to protect a network," combine multiple methods
Common Errors: ✗ Thinking penetration testing and antivirus scanning are the same ✓ Penetration testing simulates real attacks to find vulnerabilities in a system. Antivirus scanning detects known malware signatures. They test different aspects of security. ✗ Believing updating software is optional if you have antivirus ✓ Software updates often patch security vulnerabilities that antivirus cannot protect against. Antivirus detects known malware but cannot prevent exploitation of unpatched vulnerabilities. ✗ Confusing penetration testing with a real cyber attack ✓ Penetration testing is authorised and controlled — it is carried out with permission to identify weaknesses. A real attack is unauthorised and ma
Stretch & Challenge (Grade 8-9):
- Synoptic links: explain how detecting & preventing cyber threats connects to another Computer Science topic you have studied
- Real-world: research one real-world use or example of detecting & preventing cyber threats
- Critical: "What are the limitations of the models used in detecting & preventing cyber threats?"
Plenary (5 minutes)
Assessment Criteria
- Got it: Confident explanation + correct worked examples
- Getting there: Main points OK, needs support with detail
- Not yet: Confused on key concepts - re-run Lesson 2
Homework & Consolidation
- Consolidation: Re-answer any Lesson 3 practice questions answered incorrectly (20 mins)
- Retrieval: Write flashcards for the key terms: Key Concept, Why biometrics are strong, Password Best Practices (10 mins)
- Exam practice: One past-paper question on detecting & preventing cyber threats from the board websites (15 mins)
- Extension: Explain detecting & preventing cyber threats to someone else in your own words (10 mins)