Introduction to cybersecurity

DASKEREL wrote this teaching and practice using Oak's sequence as a source. View the source lesson at Oak National Academy. Oak has not endorsed this material. Check Oak's terms and separate rights for third-party works.

Learning outcomes

Distinguish data from an inference about a person
Explain why a service collects data and how misuse can harm users
Choose a privacy-protective response to an unnecessary request

Vocabulary: personal data · processing · inference · data minimisation · privacy

Retrieve previous learning

What is a computer network?

Check: A set of connected devices that can exchange data and use shared services; the internet connects many such networks.

Learn the concept

A service may need some data to work. A library account might need an identifier and a way to tell a borrower when a book is due. A list of book loans is data; an estimate of what a learner enjoys reading is an inference drawn by processing that data. Both can affect the person. A detail does not have to be secret to be personal: when it identifies a person, or can be combined with other details to do so, it deserves care.

Ask three questions of any collection: what purpose does this item serve, who can see it, and how long is it needed? A school homework service may need to remember submitted work; it does not automatically need a precise location history. Less collection and restricted access reduce the amount exposed if an account is compromised. A privacy notice should tell users what happens to their data in words they can understand.

The UK's data protection framework governs organisations' use of personal data. For children, the ICO's Children's code explains protective defaults, including high privacy and collecting only the minimum needed for a feature. A pupil should not put a real classmate's details into a classroom exercise. If an app asks for information that seems unrelated, pause and ask a teacher or trusted adult before sharing it.

Worked model

Fictional app ReadRoute asks for a nickname, year group, home address and continuous location to display a book list.
A nickname or account identifier may help keep a personal list; a year group might help suggest suitable reading, but the purpose should be explained. A home address and continuous location appear unnecessary for displaying books.
Recommend collecting only what the feature needs, making the list private by default, and asking the service to explain and remove the extra requests. This is a design judgement, not proof of legal compliance.

Guided practice

A fictional quiz site stores quiz answers and asks for a pupil's phone contacts. Which request needs scrutiny?

Hint: Compare each item with what is needed to mark and save a quiz.

Check the guided answer

Quiz answers are needed for marking. Phone contacts are not evidently needed; the pupil should decline or seek a trusted adult's help and ask why the service requests them.

Independent practice

Write your own response to every question before viewing the model answers. Your writing stays in this page session; this activity does not submit, store or grade it. Avoid including private information.

Find and correct a misconception

“Only passwords count as personal data.”

Correction: Names, identifiers, locations, activity records and combinations of details can identify a person; a password is only one sensitive example.

Extend and reflect

Design a minimum-data plan for a fictional class reading tracker.

Guidance: State a purpose for each field, who can access it and when it can be deleted. Use invented learners only.

Where this lesson could lead · Computer Science GCSE → Daskerel Cybersecurity, Digital Trust and Forensics

This lesson practises: Distinguish data from an inference about a person. Algorithms, digital systems and safe practice support later software and technology work.

Next school subject: Computer Science GCSE. Check the subject and examination board that fit your school.
Later DASKEREL learning: Daskerel Cybersecurity, Digital Trust and Forensics. Explore further study and build evidence from practical work.
Later credential exploration: Certified in Cybersecurity is an example in this later specialism. Check current awarding-body requirements before planning an exam.
Example career direction: Cybersecurity Analyst. Explore organisations and local support.

This is an exploratory route, not a promise of admission, a qualification, certification eligibility or employment. Years 7–9 learning is an early foundation; any later credential may require substantial study, experience or local approval.

Year 9 · Cyber safety and responsible use · original lesson pack

DASKEREL beta · internal AI review pending

Social engineering

DASKEREL wrote this teaching and practice using Oak's sequence as a source. View the source lesson at Oak National Academy. Oak has not endorsed this material. Check Oak's terms and separate rights for third-party works.

Learning outcomes

Recognise common social-engineering cues
Explain how trust or urgency can be exploited
Choose a safe independent verification and reporting route

Vocabulary: social engineering · phishing · impersonation · verification · reporting

Retrieve previous learning

Why should a service collect only data it needs?

Check: Unnecessary collection increases exposure and gives the service information it does not need for its stated purpose.

Learn the concept

Social engineering targets a person's decisions rather than only a technical weakness. A message may imitate a familiar school, delivery service or friend and demand quick action. Phishing uses a message or page to draw someone into sharing information or opening a harmful link. A convincing name, logo or familiar tone is not proof that the sender is genuine; addresses and accounts can be spoofed or taken over.

Look for the requested action and the pressure behind it. A fictional message saying 'your class account closes in ten minutes; tell us your password' combines urgency with a request that a legitimate helper should not need. Other examples include invented authority, prizes and a request to keep a conversation secret. A strange message does not prove malicious intent, but it does justify stopping to verify.

Do not reply, click the link, open the attachment or provide credentials while checking. Instead use a known school contact route or type the service's known address yourself. A pupil can show the message to a teacher or trusted adult and use the school's report process. If information has already been shared, ask for help promptly; the next action depends on what was shared.

Worked model

Fictional text: 'IT Help: send your class login now to keep homework access. Reply before lunch.'
Identify the clues: impersonated support role, time pressure and a request for a secret. None independently proves who sent it, but together they make the request unsafe.
Safe decision: do not send the login. Contact school IT through the established portal or ask a teacher, then report the message under school policy. Do not test its link.

Guided practice

A supposed friend sends 'click this new class photos link and sign in' from an unfamiliar account. How could you check?

Hint: Use a route you already know, not the route in the message.

Check the guided answer

Do not open the link. Ask the friend face to face or through a previously trusted channel, and show a teacher or trusted adult if it seems suspicious.

Independent practice

Write your own response to every question before viewing the model answers. Your writing stays in this page session; this activity does not submit, store or grade it. Avoid including private information.

Find and correct a misconception

“A message from a familiar account is always safe.”

Correction: Accounts can be compromised. Check unusual requests by an independent route even when the name is familiar.

Extend and reflect

Write a fictional school anti-phishing poster.

Guidance: Use three concrete steps: pause, independently verify and report. Do not create a realistic phishing page or use real details.

Where this lesson could lead · Computer Science GCSE → Daskerel Cybersecurity, Digital Trust and Forensics

This lesson practises: Recognise common social-engineering cues. Algorithms, digital systems and safe practice support later software and technology work.

Next school subject: Computer Science GCSE. Check the subject and examination board that fit your school.
Later DASKEREL learning: Daskerel Cybersecurity, Digital Trust and Forensics. Explore further study and build evidence from practical work.
Later credential exploration: Certified in Cybersecurity is an example in this later specialism. Check current awarding-body requirements before planning an exam.
Example career direction: Cybersecurity Analyst. Explore organisations and local support.

This is an exploratory route, not a promise of admission, a qualification, certification eligibility or employment. Years 7–9 learning is an early foundation; any later credential may require substantial study, experience or local approval.

Year 9 · Cyber safety and responsible use · original lesson pack

DASKEREL beta · internal AI review pending

Hacking and brute force attacks

DASKEREL wrote this teaching and practice using Oak's sequence as a source. View the source lesson at Oak National Academy. Oak has not endorsed this material. Check Oak's terms and separate rights for third-party works.

Learning outcomes

Distinguish authorised testing from unauthorised access
Explain brute-force guessing at a high level
Relate account and service protections to different threats

Vocabulary: authorisation · brute force · denial of service · account · two-step verification

Retrieve previous learning

What is an independent way to check an unexpected request for a password?

Check: Contact the service through a known address or school-approved route, not the link or number supplied in the request.

Learn the concept

Authorisation is permission to access a particular system for a particular purpose. A pupil using their own school account as intended is different from attempting to enter another person's account. A security professional may test a system only with explicit permission and clear limits. In the UK, the Computer Misuse Act addresses unauthorised access; curiosity or a claimed good intention is not permission. This lesson studies defence, not methods for trying an attack.

A brute-force attack is repeated trial and error against a protected login. Reused or predictable passwords can make account compromise more likely. A long, unique password and two-step verification help protect an account; sign-in controls such as limiting repeated attempts can also help a service. Two-step verification is an extra layer, not a promise that every compromise is impossible.

A distributed denial-of-service attack aims to overwhelm a service so legitimate users cannot use it. This is an availability problem and differs from proving that data was stolen. Defences must fit the threat: a strong password protects an account better than it protects a public website's availability. Do not use any device, website or account to demonstrate these attacks.

Worked model

Fictional school risk sheet lists: predictable shared club password; class website unavailable during a flood of unwanted requests.
Match the first to account access risk. Recommend unique credentials, two-step verification where available and no shared password; the account owner or school IT should manage changes.
Match the second to service availability risk. Escalate to school IT or service provider; password changes alone do not remove a traffic overload. Neither case invites pupil testing.

Guided practice

Why is entering a classmate's password without permission different from a teacher-approved security exercise?

Hint: Focus on the scope of permission, not technical skill.

Check the guided answer

The classmate's account is outside the pupil's permission. A supervised exercise uses an approved isolated environment and agreed scope; it does not authorise access to real accounts.

Independent practice

Write your own response to every question before viewing the model answers. Your writing stays in this page session; this activity does not submit, store or grade it. Avoid including private information.

Find and correct a misconception

“If a service is offline, its data must have been stolen.”

Correction: An availability failure does not by itself establish a confidentiality breach; evidence must be investigated by authorised staff.

Extend and reflect

Compare account takeover and service overload in a two-column defence table.

Guidance: For each, name the asset at risk, a sensible protective measure and who is authorised to act. No operational attack steps.

Where this lesson could lead · Computer Science GCSE → Daskerel Cybersecurity, Digital Trust and Forensics

This lesson practises: Distinguish authorised testing from unauthorised access. Algorithms, digital systems and safe practice support later software and technology work.

Next school subject: Computer Science GCSE. Check the subject and examination board that fit your school.
Later DASKEREL learning: Daskerel Cybersecurity, Digital Trust and Forensics. Explore further study and build evidence from practical work.
Later credential exploration: Certified in Cybersecurity is an example in this later specialism. Check current awarding-body requirements before planning an exam.
Example career direction: Cybersecurity Analyst. Explore organisations and local support.

This is an exploratory route, not a promise of admission, a qualification, certification eligibility or employment. Years 7–9 learning is an early foundation; any later credential may require substantial study, experience or local approval.

Year 9 · Cyber safety and responsible use · original lesson pack

DASKEREL beta · internal AI review pending

Malicious software

DASKEREL wrote this teaching and practice using Oak's sequence as a source. View the source lesson at Oak National Academy. Oak has not endorsed this material. Check Oak's terms and separate rights for third-party works.

Learning outcomes

Describe malware and possible routes of exposure
Distinguish bot, ransomware and a legitimate automation tool
Recommend proportionate prevention and safe reporting

Vocabulary: malware · ransomware · bot · update · backup

Retrieve previous learning

Does a website being unavailable prove its data was stolen?

Check: No. Loss of availability and theft of information are different possible effects; an investigation needs evidence.

Learn the concept

Malware is software designed to cause harm or gain access without the user's permission. It might arrive through a deceptive attachment, an untrusted download or an unpatched weakness. The effect depends on the type and the access it gains. Ransomware can make files unavailable by encrypting them and demand payment. A backup is a separate, recoverable copy of important data; it can reduce harm from lost files, although recovery still takes time.

A bot is simply software that repeats tasks automatically. A timetable reminder bot can be useful; a bot controlled without the owner's permission could send unwanted traffic or messages. Therefore automation alone is not evidence of malware. Classify a program by what it is authorised to do, whose interests it serves and its observed effects.

Protection uses layers: install updates, use trusted software sources, restrict access and keep suitable backups. Do not investigate a suspicious attachment by opening it. On a school device, stop interacting with it and tell school IT or a teacher according to the school's process. A written scenario can explain a response, but it does not assess safe hands-on malware handling.

Worked model

Fictional tablet displays a message demanding money after a file from an unknown sender was opened; class notes cannot be accessed.
Describe a possible ransomware incident, while recognising that a screen message alone is not a final diagnosis. The missing notes show an availability problem; whether data was copied is unknown.
Do not pay, open more files or experiment. Inform school IT through a trusted route. They can investigate, isolate and recover using school procedures and verified backups.

Guided practice

A scheduled class reminder sends one approved message each Friday. Is it necessarily malware because it is a bot?

Hint: Automation and intent are separate.

Check the guided answer

No. A bot can be benign if authorised and used for its stated purpose. A harmful bot uses automation in an unauthorised or damaging way.

Independent practice

Write your own response to every question before viewing the model answers. Your writing stays in this page session; this activity does not submit, store or grade it. Avoid including private information.

Find and correct a misconception

“Every automated bot is malicious.”

Correction: Bots are automated programs; whether a bot is harmful depends on its authorisation, purpose and effects.

Extend and reflect

Draw a prevention-and-recovery plan for a fictional school laptop.

Guidance: Include updates, trusted downloads, restricted access, reporting and backups. Describe decisions only; do not obtain or run suspect software.

Where this lesson could lead · Computer Science GCSE → Daskerel Cybersecurity, Digital Trust and Forensics

This lesson practises: Describe malware and possible routes of exposure. Algorithms, digital systems and safe practice support later software and technology work.

Next school subject: Computer Science GCSE. Check the subject and examination board that fit your school.
Later DASKEREL learning: Daskerel Cybersecurity, Digital Trust and Forensics. Explore further study and build evidence from practical work.
Later credential exploration: Certified in Cybersecurity is an example in this later specialism. Check current awarding-body requirements before planning an exam.
Example career direction: Cybersecurity Analyst. Explore organisations and local support.

This is an exploratory route, not a promise of admission, a qualification, certification eligibility or employment. Years 7–9 learning is an early foundation; any later credential may require substantial study, experience or local approval.

Year 9 · Hardware, networks and the internet · original lesson pack

DASKEREL beta · internal AI review pending

Protecting networks from security threats

DASKEREL wrote this teaching and practice using Oak's sequence as a source. View the source lesson at Oak National Academy. Oak has not endorsed this material. Check Oak's terms and separate rights for third-party works.

Learning outcomes

Compare likelihood and impact without pretending to know exact probabilities
Choose controls that address different risks
Explain why people and technical safeguards work together

Vocabulary: threat · likelihood · impact · access control · defence in depth

Retrieve previous learning

Why is a backup useful if ransomware makes files unavailable?

Check: A safe and tested separate copy can support recovery, although work may still be lost and the incident must be investigated.

Learn the concept

A network links devices and services, so one security problem can affect more than one person. A risk decision combines how plausible a threat is with how serious its consequences could be. An invented risk grid is useful for discussion, but its labels are not measured probabilities. A rare event with severe consequences may still deserve preparation; a frequent small nuisance may need a different response.

Controls should match the asset and failure route. Unique credentials and two-step verification protect accounts. Updating software can fix known weaknesses. Access controls limit what an account can do. Backups support recovery after data loss. Staff training helps people notice and report suspect requests. These controls work together; none proves that a whole school network is secure.

Consider a fictional school with pupil records, lesson files and a public information page. Pupil records need restricted access and careful handling. Lesson files need reliable backup and availability. The public page should remain reachable, but a pupil should not test its resilience. A teacher or IT team decides controls and incident handling; a learner can reason about them on paper.

Worked model

Fictional risk table: A, a shared staff password may expose pupil records; B, a damaged drive may make lesson files unavailable.
For A, the potential impact on privacy is high. Recommend individual accounts, appropriate access limits and two-step verification; ask school IT to assess likelihood rather than inventing a percentage.
For B, a tested backup and recovery plan address lost files. Password rules alone do not restore a failed drive. Both risks need a reporting owner and periodic review.

Guided practice

Which control better addresses accidental deletion of class files: two-step verification or a tested backup?

Hint: Think about what must be restored.

Check the guided answer

A tested backup directly supports restoring deleted files. Two-step verification protects account sign-in but does not by itself restore lost data.

Independent practice

Write your own response to every question before viewing the model answers. Your writing stays in this page session; this activity does not submit, store or grade it. Avoid including private information.

Find and correct a misconception

“One security product makes a network safe.”

Correction: Risk changes with users, software and threats; layers of controls, monitoring and recovery planning are needed.

Extend and reflect

Write a one-page fictional school risk register.

Guidance: For three assets, state a threat, plausible effect, suitable control and responsible staff role. Do not inspect any real school configuration.

Where this lesson could lead · Computer Science GCSE → Daskerel Cloud and Infrastructure

This lesson practises: Compare likelihood and impact without pretending to know exact probabilities. Algorithms, digital systems and safe practice support later software and technology work.

Next school subject: Computer Science GCSE. Check the subject and examination board that fit your school.
Later DASKEREL learning: Daskerel Cloud and Infrastructure. Explore further study and build evidence from practical work.
Later credential exploration: AWS Certified Cloud Practitioner is an example in this later specialism. Check current awarding-body requirements before planning an exam.
Example career direction: Cloud Support Engineer. Explore organisations and local support.

This is an exploratory route, not a promise of admission, a qualification, certification eligibility or employment. Years 7–9 learning is an early foundation; any later credential may require substantial study, experience or local approval.

Year 9 · Cyber safety and responsible use · original lesson pack

DASKEREL beta · internal AI review pending

Preventing cyber attacks

DASKEREL wrote this teaching and practice using Oak's sequence as a source. View the source lesson at Oak National Academy. Oak has not endorsed this material. Check Oak's terms and separate rights for third-party works.

Learning outcomes

Trace a cyber incident's effects on different people
Distinguish prevention, detection, response and recovery
Build a layered plan from a public case without claiming perfect prevention

Vocabulary: incident · prevention · detection · response · recovery

Retrieve previous learning

Why do updates and training address different risks?

Check: Updates can fix known software weaknesses; training helps people recognise and report unsafe requests. Neither replaces the other.

Learn the concept

Cyber incidents can affect individuals, organisations and public services. Costs are not only financial: unavailable records can delay work, and uncertainty can disturb people who depend on a service. A published case should be used carefully. The 2017 WannaCry ransomware outbreak disrupted organisations including parts of the NHS. NCSC's public guidance stresses updates and safe backups; the case does not show that one single measure would have guaranteed safety everywhere.

Separate the stages of a sensible plan. Prevention reduces opportunities for harm, such as software updates, restricted access and strong account protection. Detection means noticing unusual signs and reporting them. Response is for authorised staff to contain and investigate; pupils should not diagnose a live incident by opening files or probing devices. Recovery restores services and information using tested procedures and backups.

The best explanation links a control to a particular effect. A backup can help restore files but does not stop someone receiving a deceptive message. Two-step verification can reduce account takeover but does not replace patching vulnerable software. A school needs clear reporting routes so a small concern reaches the right person promptly. The classroom task is a paper plan for an invented organisation, not an operational security audit.

Worked model

Fictional community centre has booking files, staff accounts and a public schedule. A suspect file is reported; bookings are unavailable.
State known effects first: booking access is lost. Do not infer that private data was stolen without evidence. A staff member should contact the organisation's designated IT or incident lead.
Plan layers: trusted updates and account controls before an incident; a clear report and authorised containment during it; a tested backup and service restoration afterwards. Review what actually happened before changing the plan.

Guided practice

Place 'restore from verified backup' and 'tell the incident lead about an unusual file' into the right stages.

Hint: One finds a problem; the other helps resume service.

Check the guided answer

Reporting an unusual file supports detection and response. Restoring a verified backup is recovery, carried out by authorised staff.

Independent practice

Write your own response to every question before viewing the model answers. Your writing stays in this page session; this activity does not submit, store or grade it. Avoid including private information.

Find and correct a misconception

“A backup prevents an infection.”

Correction: Backups support recovery; prevention and detection require other measures, such as updates, safer access and reporting.

Extend and reflect

Prepare a short fictional incident timeline and improvement plan.

Guidance: Separate observed facts from unknowns and list one action each for prevention, detection, response and recovery. Do not claim to have examined a live incident.