GCSE Computer Science
Learn how to protect computer systems and networks from threats.
Explore common cyber threats including malware, phishing, social engineering, and denial-of-service attacks. Understand security measures such as firewalls, encryption, authentication, and access control.
This unit covers password security, network policies, penetration testing, and best practices for keeping systems and data safe.
⚠️
AI-Generated Content - Not Yet Reviewed
This lesson content has been partially generated using AI and has not yet been reviewed by a human educator. It likely contains numerous issues, inaccuracies, and pedagogical problems. Do not use this content for actual lesson planning or teaching at this time.
In 2017, the NHS was crippled by a cyberattack. Operations cancelled. Ambulances diverted. Lives at risk. How did hackers bring down an entire healthcare system?
Show news footage or images from the WannaCry attack on the NHS. Display the ransom screen that appeared on thousands of hospital computers. Ask students: 'How do you think malicious software got onto these computers? Who would do this, and why?' Collect initial thoughts.
Resources:
Screenshot of the infamous red ransomware demand screen
2-minute segment on NHS WannaCry impact
Teacher Notes:
This is an emotionally impactful hook - hospitals, vulnerable patients. Let students feel the gravity before moving to technical content. Some students may have personal connections to NHS care.
Interactive presentation introducing malware types. For each type (virus, worm, trojan, ransomware, spyware), show: what it does, how it spreads, a real example, and an analogy. Students complete a 'Malware ID Card' worksheet for each type.
Analogies:
Resources:
Template with spaces for: Name, Type, How it spreads, What it does, Real example, Danger level
Teacher Notes:
Use the analogies but also challenge students to create their own. The ID card activity keeps them engaged during what could be a lecture section.
Display a series of emails/messages on screen (mix of genuine and phishing). Students work in pairs to identify which are phishing attempts and explain their reasoning. Include increasingly sophisticated examples:
After each reveal, discuss the red flags. Introduce the concept that social engineering exploits trust, urgency, fear, and curiosity.
Resources:
6-8 emails ranging from obvious to sophisticated, redacted appropriately for student viewing
Teacher Notes:
The progression from obvious to convincing is important - students often think they'd never fall for it, then struggle with the sophisticated ones. This builds humility about human vulnerability.
Discussion and mini-lecture on why humans are often easier to 'hack' than computers. Cover psychological principles attackers exploit:
Show examples of social engineering beyond phishing: tailgating, pretexting, baiting (infected USB drives left in car parks).
Teacher Notes:
This connects to broader life skills. Emphasise that being cautious isn't paranoid - it's smart. Ask: 'Why might attackers prefer social engineering to technical hacking?' (Easier, faster, harder to detect)
Brief ethical discussion: Security professionals use social engineering techniques to test organisations (covered in Lesson 4). Is deception ever acceptable? What about governments using these techniques? What about journalists?
Link to careers: Social engineering skills (understanding psychology, communication) are valued in cybersecurity, marketing, and many other fields.
Teacher Notes:
Keep this brief but plant the seed that ethics in security is complex. Some students may raise controversial examples - acknowledge the complexity.
Quick-fire activity: Display 5 scenarios (email, pop-up, USB stick found, phone call). Students hold up green card (safe) or red card (danger). Discuss any where opinions differed.
Exit ticket: 'What's one thing you'll do differently online after today's lesson?'
Resources:
5 realistic scenarios for rapid judgment
Or use thumbs up/down if cards unavailable
Teacher Notes:
The personal commitment at the end helps transfer learning to real behaviour. Next lesson will cover technical attacks.
Deep dive into the 2017 WannaCry ransomware attack that affected 200,000 computers across 150 countries. Explore how it spread, why the NHS was particularly vulnerable, and how a young security researcher accidentally stopped it by registering a domain name.
Connection: Demonstrates real-world impact of malware and shows how devastating ransomware can be when combined with worm-like spreading capabilities.
Further Reading:
Brief look at Kevin Mitnick, once the FBI's most wanted hacker, who primarily used social engineering rather than technical hacking. Now a respected security consultant.
Connection: Shows that 'hacking' isn't just about code - understanding human psychology is equally important, linking to why people are the 'weak point'.
Further Reading:
Support:
Stretch:
https://www.ncsc.gov.uk/collection/phishing-scams - Official UK government guidance
https://www.bbc.co.uk/sounds/brand/m000rjsy - 'The Lazarus Heist' podcast
https://www.malwarebytes.com/malware - Accessible explanations
https://haveibeenpwned.com/ - Students can check if their email has been in a breach (educational discussion point)
A 16-year-old's password was '123456'. It took a computer exactly 0.0001 seconds to guess it. How long would it take to guess yours?
Display live password strength checker (howsecureismypassword.net or similar - DO NOT have students enter real passwords, use fake examples). Show how adding length and complexity exponentially increases cracking time.
Demonstrate: 'password' = instant, 'Password1' = seconds, 'P@ssw0rd!' = minutes, 'MyD0g$Name!2024' = years.
Ask: 'If computers keep getting faster, is any password safe? What else might attackers try?'
Resources:
Pre-prepared examples to type in (never real passwords)
Teacher Notes:
CRITICAL: Never have students test real passwords on any website. Use fictional examples only. This naturally leads into brute-force discussion.
Explain brute-force attacks using physical analogy: like trying every combination on a padlock (000, 001, 002...). Work through the maths together:
Introduce dictionary attacks as 'smart brute force' - trying common passwords first.
Activity: Students calculate combinations for different password types using formula: (possible characters)^(length)
Resources:
Guided calculations for different password scenarios
Teacher Notes:
This connects to maths skills. Help students see that the exponential growth is what makes longer passwords dramatically stronger.
Explain DoS using real-world analogy: imagine 1000 people calling a shop's phone line simultaneously - genuine customers can't get through.
Introduce concepts:
Show diagram of DDoS attack with compromised devices. Brief video showing Mirai botnet attack's impact.
Discussion: 'Why would someone launch a DoS attack?' (Extortion, protest/hacktivism, competition, distraction for other attacks, revenge)
Resources:
Visual showing botnet structure
1-2 minute overview of 2016 attack
Teacher Notes:
Students often understand this concept quickly. Spend time on 'why' - motivations matter for understanding threats.
Explain how data travelling over networks can be intercepted:
Analogy: Like someone opening and reading your letters before resealing them.
Quick demo: Show Wireshark (or screenshot) capturing unencrypted data to show what attackers might see. Emphasise what can be stolen: login credentials, bank details, private messages.
Resources:
Pre-captured packet data showing readable text (sanitised example)
Teacher Notes:
Wireshark demo is powerful but don't install on school machines without permission. Screenshots work well.
Explain SQL injection conceptually (students don't need to know SQL syntax for exam):
Show classic example: Instead of username, entering: admin' -- (The ' ends the text field, -- comments out the password check)
Analogy: It's like writing on a form: 'Give me [your name]' and someone writes 'Give me [all the money and delete the records]'
Optional demo: Use a safe SQL injection practice website (like DVWA or WebGoat) if available.
Resources:
Visual showing how malicious input manipulates database query
Teacher Notes:
Keep this conceptual - exam doesn't require actual SQL knowledge. The Bobby Tables XKCD comic is a great visual if you can show it.
In pairs, students create 'attack profile cards' for each attack type covered. Each card must include:
Groups can swap and peer-assess accuracy.
Resources:
Structured template for each attack type
Teacher Notes:
This consolidates learning in an active way. Keep pace brisk - cards don't need to be perfect, just show understanding.
Quick quiz: Present scenarios, students identify which attack type applies:
Exit ticket: 'Which attack do you think is most dangerous, and why?'
Teacher Notes:
The opinion question has no wrong answer - it reveals understanding and encourages critical thinking. Preview next lesson: 'Now we know the threats, how do we defend against them?'
Explore the maths behind password security. A 6-character lowercase password has 26^6 (308 million) combinations - sounds like a lot, but modern computers can try billions per second. Calculate how password length and character sets exponentially increase security.
Connection: Deepens understanding of brute-force attacks by connecting to mathematics. Shows why 'longer is stronger' and why random characters matter.
Further Reading:
In 2016, a massive DDoS attack brought down Twitter, Netflix, and major websites. The attackers used an army of hacked webcams, baby monitors, and smart devices. Explore how IoT (Internet of Things) security failures enabled one of the largest DDoS attacks in history.
Connection: Real-world example of DoS attacks at scale, connecting to embedded systems (from Unit 1.1.3) and network concepts. Shows why security matters for ALL connected devices.
Further Reading:
Companies like Google, Facebook, and Microsoft pay hackers to find vulnerabilities. Some ethical hackers earn six-figure sums from bug bounties. Brief look at how you can get started with platforms like HackerOne.
Connection: Shows positive career paths using knowledge of attacks. Links to penetration testing (Lesson 4).
Further Reading:
Support:
Stretch:
https://howsecureismypassword.net/ - Safe password strength demonstration
https://xkcd.com/936/ - Classic comic explaining password entropy
https://xkcd.com/327/ - Famous comic on SQL injection
https://www.cloudflare.com/learning/ddos/what-is-a-ddos-attack/ - Clear explanations with visuals
Prerequisites: 1
Your smartphone probably has better security than most bank vaults 50 years ago. What makes it so secure?
Ask students to list security features on their phone: PIN/passcode, fingerprint, face recognition, encryption, app permissions, remote wipe capability.
Reveal: A modern smartphone uses multiple layers of security that work together. Today we'll explore these defences and understand how they protect us.
Teacher Notes:
Most students will know some features but not understand them as a 'defence in depth' strategy. This lesson teaches them to think systematically about security.
Explain how anti-malware software works:
Discuss limitations:
Brief activity: Students list 3 things anti-malware can protect against and 2 things it can't (linking back to lesson 1 threats).
Resources:
Visual showing signature matching and behavioural analysis
Teacher Notes:
Emphasise that anti-malware is essential but not sufficient alone - it's one layer of defence.
Explain firewalls using analogy: Like a security guard checking everyone entering a building.
Concepts to cover:
Show example firewall rules: 'Allow web browsing (port 80/443)', 'Block unknown programs accessing internet', 'Alert on suspicious connections'
Link to DoS attacks: Firewalls can help filter attack traffic, but massive DDoS may overwhelm even good defences.
Resources:
Visual showing firewall between internal network and internet
Screenshot of typical firewall configuration
Teacher Notes:
Students don't need to configure firewalls, just understand their purpose and basic operation.
Build on brute-force lesson with defence strategies:
Good password practices:
Introduce passphrase concept: 'correct horse battery staple' is stronger than 'P@ssw0rd!'
Discuss multi-factor authentication (MFA):
Why MFA matters: Even if password is stolen, attacker needs second factor.
Brief mention of password managers as practical solution.
Resources:
Visual comparing different password strategies
Teacher Notes:
This is directly actionable - students can improve their own password practices. Encourage them to enable MFA on important accounts.
Explain encryption conceptually:
Start with simple cipher example: Caesar cipher where each letter shifts by 3 (A→D, B→E). Have students encrypt 'HELLO' (KHOOR).
Explain that real encryption is vastly more complex - AES-256 has more possible keys than atoms in the observable universe.
Cover key concepts:
Link back to data interception: Encrypted data is useless to interceptors.
Resources:
Quick hands-on encryption exercise
Visual showing plaintext → encrypted → decrypted flow
Teacher Notes:
The Caesar cipher is deliberately simple - make clear that real encryption is unimaginably more complex. The mathematical details aren't needed for GCSE.
Consolidate learning: Draw 'layers of security' diagram together showing how defences work together:
Outer: Firewall (blocks bad traffic) Next: Anti-malware (catches threats that get through) Next: Encryption (protects data even if intercepted) Inner: Strong passwords + MFA (last line of defence)
Quick quiz: For each threat from lessons 1-2, identify which defence(s) would help.
Exit ticket: 'Which defence do you think is most important, and why?' (Trick question - the answer is 'all of them working together')
Resources:
Concentric circles to fill in
Teacher Notes:
The 'defence in depth' concept is crucial - no single protection is enough. This prepares for next lesson on human and organisational security.
Explore the three types of authentication factors: something you know (password), something you have (phone/key), something you are (fingerprint/face). Discuss why combining these makes accounts dramatically more secure and why MFA is becoming standard.
Connection: Extends password discussion to show modern authentication practices. Helps students protect their own accounts.
Further Reading:
Examine how end-to-end encryption in WhatsApp and Signal works - even the companies can't read your messages. Discuss the tension between privacy and law enforcement access.
Connection: Deepens encryption understanding with practical example students use daily. Links to ethical considerations.
Further Reading:
Brief look at how password managers work (one master password to unlock a vault of unique, complex passwords). Discuss the risk/benefit trade-off and why security experts recommend them.
Connection: Practical application of password security principles. Gives students actionable advice.
Further Reading:
Support:
Stretch:
https://www.ncsc.gov.uk/collection/passwords - Official UK guidance
https://ssd.eff.org/ - Accessible security guides
https://twofactorauth.org/ - Shows which sites support MFA
Prerequisites: 2
Companies pay hackers thousands of pounds to break into their systems. Why would they do that?
Share story: In 2019, a security researcher found a bug in Apple's systems that could have given him access to any iCloud account. Apple paid him $100,000 in bug bounty.
Ask: Why would Apple pay someone to find problems in their own systems? Isn't that dangerous?
Collect answers, then reveal: This is called penetration testing, and it's one of the most in-demand careers in cybersecurity.
Resources:
Examples of major payouts and findings
Teacher Notes:
The money angle captures attention. Make clear distinction between legal/illegal hacking - intent and permission matter.
Explain penetration testing:
Show example pen test report structure (sanitised).
Discuss: Why is it better to find vulnerabilities before criminals do?
Link to earlier lessons: Pen testers use all the attack methods we learned about (but legally and with permission).
Resources:
Flowchart of penetration testing phases
Template showing how findings are documented
Teacher Notes:
Emphasise the legal and ethical boundaries. Some students may be tempted to 'try things' - be very clear this must only be done with explicit permission.
Introduce principle of least privilege: Users should have minimum access needed for their job.
Example scenario: In a school network
Activity: Present business scenario (e.g., hospital). In groups, decide access levels for: receptionist, nurse, doctor, IT support, hospital director. Justify decisions.
Discuss: What could go wrong if everyone had full access? (Link to insider threat, accidental deletion, malware spreading)
Resources:
Different organisational contexts for group work
Teacher Notes:
This connects to their own experience - they've probably noticed different access levels at school. Make it concrete.
Remind students: All our digital security means nothing if someone can physically access the computers.
Physical security measures:
Show Google data centre security video clip (or images) - biometric mantrap doors, visitor escorts, drive destruction.
Activity: 'Physical Security Audit' - students identify physical security measures (or lack thereof) in their own school/classroom. What's good? What could be improved? (Keep it constructive!)
Resources:
Visual of enterprise-level physical security
Template for classroom audit activity
Teacher Notes:
The classroom audit makes this immediately relevant. Be careful not to encourage students to identify 'weaknesses' that could be exploited - focus on positive observations.
Discuss tensions in security:
Group discussion: Present scenario where security measure (e.g., banning USB drives) helps security but hurts productivity. How do you balance?
Link to 1.6 ethical, legal, cultural, environmental issues.
Teacher Notes:
This prepares for the ethics unit. There are no easy answers - model that it's okay to wrestle with complexity.
Final consolidation: Present a business scenario (e.g., small company with 20 employees, some working remotely, handling customer payment data).
In pairs, create a security plan covering:
Share and compare plans. Discuss: Why do companies need multiple layers of protection?
Final exit ticket: 'If you could give one piece of security advice to everyone in your family, what would it be and why?'
Resources:
Structured worksheet for comprehensive planning
Teacher Notes:
This brings everything together. The personal advice question encourages transfer of learning to real life.
Explore the career path of ethical hackers/penetration testers. Look at certifications (CEH, OSCP), typical salaries, and what a day in the life looks like. Include stories of famous ethical hackers who've found critical vulnerabilities.
Connection: Shows penetration testing as a genuine career path. May inspire students considering security careers.
Further Reading:
Discuss how employees and insiders pose unique security risks - either through malice, negligence, or coercion. Look at famous cases like Edward Snowden (controversial) and how organisations balance trust with security.
Connection: Deepens understanding of user access levels and why principle of least privilege matters.
Further Reading:
Virtual tour of how major cloud providers (Google, AWS, Microsoft) physically secure their data centres. Mantraps, biometrics, security guards, destruction of old drives, disaster recovery.
Connection: Makes physical security tangible by showing how seriously major companies take it. Connects to 'the cloud' concept from networks unit.
Further Reading:
Support:
Stretch:
https://www.gchq.gov.uk/section/careers/cyber-discovery - GCHQ youth programme
https://tryhackme.com/ - Legal practice platform for ethical hacking
YouTube tour of Google's physical security measures
https://www.hackerone.com/ - Bug bounty platform showing real payouts
Prerequisites: 1, 2, 3