|
|
|
|
Spooky Cyber Fridays for Cybersecurity Awareness Month
|
|
|
Make cybersecurity awareness fun and engaging this October with Spooky Cyber Fridays: Mini-Lessons for Cybersecurity Awareness Month, available on CLARK!
|
This four-part series features short, interactive cybersecurity activities that get students investigating real-world digital safety challenges. Each 15–20 minute mini-lesson explores a different topic, including phishing, password security, malware, and AI safety.
|
|
Designed to be easily incorporated into the school day, Spooky Cyber Fridays uses cyber investigations, class discussions, and interactive challenges to help students practice one important habit:
|
|
|
|
|
Part of the CLARK4Kids Collection:
|
This is a direct link and you will need to log in to download
|
|
|
|
|
|
Teaching Students to Ask the Next Cybersecurity Question
|
What are you teaching today that will still matter five years from now?
|
Thoughts from the desk of Melissa Dark
|
|
Look at a lesson you taught recently. Some of what students learned may have a very long life: how authentication works, why least privilege matters, or how to reason about risk. Other knowledge may have a much shorter one: a particular tool, attack, command, vulnerability, or configuration. We need both, but we should not mistake them for the same kind of knowledge.
|
Cybersecurity knowledge exists along a gradient of half-lives. Tools change. Systems change. New vulnerabilities appear and defenses improve. Adversaries adapt to what defenders know and do. At the same time, principles such as least privilege and defense in depth endure, as do ways of thinking about confidentiality, integrity, availability, risk, systems, and adversaries. The challenge for cybersecurity teachers is therefore not simply deciding what knowledge students need. It is deciding what we want students to carry forward after some of the specifics we teach them have expired.
|
I find one distinction useful: The current content is the vehicle. The habit of mind is the cargo. A current breach can be the vehicle for learning to think adversarially. A network configuration can be the vehicle for systems thinking. A vulnerability can be the vehicle for reasoning about risk. This does not make the technical details unimportant. Students cannot reason well about systems they do not understand. Rather, the specifics give students something concrete with which to develop ways of thinking that can outlast the particular technology.
|
That distinction changes what we might ask students to do with what they learn. Suppose students are learning multi-factor authentication. They need to understand authentication factors and why MFA can provide additional protection. But consider what happens when we put that knowledge into a situation: A company protects employee accounts with passwords and SMS authentication codes. An attacker successfully SIM-swaps an employee's phone number. Is the account adequately protected?
|
|
Knowing the definition of MFA gets the student into the problem, but it does not resolve it. What does the attacker now control? What assumptions did the organization make? What other protections are present? What can the employee access? What would the attacker likely do next? What else would we need to know before recommending a response? The student has moved from demonstrating knowledge to thinking with knowledge.
|
|
Cybersecurity Knowledge and Context
|
|
|
This is where cross-cutting ideas can become especially powerful. CIA, risk, systems thinking, defense in depth, and adversarial thinking need not be topics students learn once and leave behind. They can become lenses students repeatedly use. Faced with the MFA situation, one student might consider what information or systems are at risk. Another might look beyond the login process to account recovery, cellular providers, connected applications, and users as parts of a larger system. Defense in depth prompts the question of what stands behind this control if it fails. Adversarial thinking asks what an attacker who has successfully taken control of the phone number would do next.
|
The particular problem will change, but the lenses travel. Students can use them again when examining ransomware, a network configuration, social engineering, cloud security, or an AI system. Each encounter also gives us an opportunity to deepen the thinking. A beginning student may ask whether confidentiality is protected. A more experienced student may ask whose information requires confidentiality, from whom, under what circumstances, and what happens when protecting confidentiality creates consequences for availability. The vocabulary may be the same, while the quality of the reasoning has changed.
|
|
Cybersecurity adds another complication: sometimes there is an intelligent adversary on the other side of the problem. A failed disk does not care what the defender does; an attacker does. Attackers can observe defenses, exploit assumptions, deceive users, change tactics, and anticipate responses. Students therefore need practice reasoning about motives, incentives, knowledge, capabilities, and likely actions. At the same time, not every failure is an attack. An unavailable system might result from malicious activity, hardware failure, configuration error, or human error. Good cybersecurity judgment includes considering both intentional and non-intentional causes and determining which kind of problem the evidence supports.
|
|
Implications for Assessment
|
All of this has implications for assessment. Students should certainly be able to define concepts, explain how technologies work, and demonstrate foundational technical knowledge. But we also need to know whether they can use that knowledge when the situation does not look exactly like the example from class. Instead of only asking students to define systems thinking, we can give them a system and ask what they see. Instead of only asking them to identify a vulnerability, we can ask how serious it is in a particular setting and what additional information they would need before deciding.
|
That last question may be especially important. In cybersecurity, competence does not always mean knowing the answer. Sometimes it means recognizing that you do not yet have enough information to answer responsibly. What a student notices, the questions they ask, the assumptions they challenge, the evidence they seek, and whether they recognize when they need to keep thinking can tell us something that recall alone cannot.
|
Cybersecurity education cannot give students everything they will need to know. The field will make sure of that. Some of what we teach will endure and some will not. Technology will change, context will change what familiar facts mean, defenses will fail, and adversaries will adapt.
|
So perhaps the most useful questions for us as teachers are these: What in this lesson will still matter in five years? Are my students learning to think with what they know, or only to repeat it? And when they reach an answer, have I taught them to know when they need to ask the next question?
|
|
That may be some of the most durable cybersecurity knowledge we can give them.
|
|
|
|
|
|
|
   
|
DARK Enterprises Inc. is a non-profit dedicated to developing, supporting, and stewarding excellent cybersecurity education at the secondary level. We provide leadership, resources, training, and partnerships in support of assuring the U.S. has a robust and reliable talent pipeline in cybersecurity.
|
|
|
|
|
