Background and Rationale

Why Should Students Learn Cybersecurity?

Cybersecurity teaches students about protection of computer operating systems, networks, and data from cyber attacks. They learn how to monitor systems, assess risks to systems, and mitigate threats. For example, younger students should be aware of the consequences of using passwords that can be easily guessed and older students should learn means to minimize their risk on public wi fi and social media. As the world becomes more digitally connected, the field has growing global importance and the number of job openings at all levels is growing. 

Key Concepts: Adversarial Thinking, Threat Modeling, Risk Assessment

Goal: The educator creates or selects and implements an activity that requires students to engage in modeling and weighing the risks associated with a cyber threat using situational perspective and adversarial thinking. 

What is Adversarial Thinking? Threat Modeling? Risk Assessment?

Threat Modeling is an organized process to identify potential security threats and vulnerabilities, rate the seriousness of each, and prioritize techniques to prevent or lessen the severity of attacks and protect resources. These threats can be intentional or unintentional.

Adversarial thinking considers all of the ways that a system might be compromised by the "bad guys". This is a useful tool for Threat Modeling.

Risk Assessment considers all of the costs of protecting information: time, money, and resources; and balances those against the likelihood of an attack, along with the cost of the damage that could be done by an attack in order to make recommendations on how to prioritize security measures.

In any organization there are always going to be risks involved that need to be managed. Risks fall into two main categories: inherent risks (risks that cannot be avoided) and residual risk (what remains after measures are taken to stop the inherent risks). Every organization also has a risk appetite, or level of risk, that they are willing to assume.

When assessing risk, possible threats need to be considered and weighted. Threats can be environmental: hurricane, tornado, earthquake, etc. There are also man-made threats like external attempts to disrupt an organization,  as well as accidental or intentional disruptions by employees. Companies should always be aware of their risks or have a good sense of risk awareness. An external evaluation is known as a risk control assessment while an internal evaluation is a risk control self-assessment. To be able to provide some sort of measurement on threats, a quantitative evaluation can be performed to include Single Loss Expectancy (SLE) or an Annualized Rate of Occurrence (ARO) to give people an understanding of the likelihood of a particular threat affecting you. Adversarial thinking requires evaluating a system by thinking about how to exploit and undermine it and identifying ways to alter its content and integrity. A complete understanding of potential risk includes knowledge of possible system compromises by adversaries. (Adapted from Cyber.org)

Assessment Rubric

To earn this micro-credential, you must receive a “passing” score for Parts 1, 2 and 3. 

Part 1: Identification and implementation of the Activity

Describe the activity (up to 1 page) including these details:

1. Intended grade levels

2. Intended prior experience recommended for students

3. Approximate time needed to implement the lesson.

4. Engagement or warm-up activity

5. Key take aways. Describe what students will be able to do upon completion of the lesson.

6. Source of the activity (or reference sources used to create the activity) with a description of any adaptations made.

7. Alignment to standards

8. Differentiation and instructional supports

9. Assessment