Embedded Files
10-26-26 If you're that good/fast, build 2 computers! :-)
Objective: Students will be able to connect computer peripherals, networking equipment, display cables, and power devices. Using the interactive computer-building simulator shown in your screenshot, students will practice making connections, troubleshoot mistakes, and verify a working computer setup.
Left click and hold to see where to connect.
Press Test to see what you are missing.
Knowledge Check Put your answers in the notes app.
Screenshot your working computer and your knowledge check answers!
10-19-26
Objective: Students will be able to analyze cybersecurity threats, investigate security incidents, and apply defense-in-depth principles to design a multilayered security strategy that protects organizational assets, reduces vulnerabilities, and maintains security when individual controls fail.
Student deliverables
Baseline assessment: identify the weaknesses of a firewall-only strategy.
Layer investigation: one concrete security control for each of seven practical layers, with purpose and failure backup.
Evidence analysis: interpret simulated login, web, endpoint, and alert records.
Decision simulation: select defenses and explain outcomes, including one control failure.
Final blueprint: select seven controls and explain how they reinforce each other.
Executive justification: make an evidence-based recommendation to the pharmacy owner.
Knowledge check and reflection: demonstrate independent mastery.
HINT: Question 1: Your Mission
Question: In your own words, what must you prove to the pharmacy owner?
Student Hint:
Think about what could happen if LocalCare Pharmacy relies on only one firewall to protect its computers, patient records, and prescription systems.
Consider these questions:
What happens if an employee accidentally gives away their password?
Can a firewall stop every type of cyberattack?
How could additional security protections help if the firewall fails?
Sentence Starter:
"My job is to show the pharmacy owner why one firewall is not enough to protect the business. I will explain how different security measures can work together to..."
10-15-26
Objective: Students will be able to identify, classify, and explain different types of cybersecurity security controls and apply their knowledge to real-world scenarios by selecting appropriate controls to protect organizational systems, networks, and data from security threats. Research tools (Internet access, computers, recent books, etc.)
10-15-26
Objective: Students will be able to understand how computer networks function by identifying key networking devices, explaining how data travels between devices, and distinguishing among different types of networks (PAN, LAN, WLAN, CAN, MAN, and WAN) based on their purpose, size, and geographic coverage.
The central focus of the course
Organize teaching/learning around one recurring cybersecurity process:
UNDERSTAND → OBSERVE → IDENTIFY → ANALYZE → PROTECT → JUSTIFY
**Students need to understand a system/network well enough to:
Understand what normal looks like → examine evidence → recognize something abnormal → identify the attack/vulnerability → determine the security impact → choose a mitigation → explain why.
Knowing Your Network is therefore going in exactly the right direction. But networking is not the end goal. Networking becomes the foundation that allows students to perform cybersecurity analysis.
The FRQ demonstrates this especially well. Students are given six sources from the same device—firewall configuration, web logs, network logs, authentication logs, Linux file permissions, and a password policy—and then have to correlate them to make security decisions.
That is probably the single most important instructional clue!
**Exercise - FOR EXpert PRACTICE**
**Exercise - FOR EXpert PRACTICE**
Situation Log: Something Isn't Right
Situation Log: Something Isn't Right
You are a cybersecurity analyst for Northview High School. During routine monitoring, an alert is generated for a server containing student records.
The server normally provides HTTPS access to authorized users and allows SSH administration from the school's internal network.
Study the log carefully. Not every unusual-looking entry represents an attack.
Quick Reference for Students
Quick Reference for Students
Field Meaning
SRC Source IP — where the traffic came from
DST Destination IP — where the traffic is going
PROTO Network protocol being used
DPT Destination port
ACTION=ACCEPT Firewall allowed the connection
ACTION=BLOCK Firewall blocked the connection
GET Request sent to a web server
STATUS=200 HTTP request was successfully processed
STATUS=400 Server considered the HTTP request invalid/malformed
443 HTTPS
22 SSH
53 DNS
3306 MySQL
Oct 05 09:12:14 SRC=192.168.10.24 DST=10.10.20.15
PROTO=TCP DPT=443 ACTION=ACCEPT
Oct 05 09:14:31 SRC=192.168.10.31 DST=10.10.20.15
PROTO=TCP DPT=443 ACTION=ACCEPT
Oct 05 09:18:07 SRC=192.168.10.8 DST=10.10.20.15
PROTO=TCP DPT=22 ACTION=ACCEPT
Oct 05 09:22:41 SRC=185.44.72.19 DST=10.10.20.15
PROTO=TCP DPT=443 ACTION=ACCEPT
Oct 05 09:22:46 WEB GET /login.php?user=admin
SOURCE=185.44.72.19 STATUS=200
Oct 05 09:22:51 WEB GET /search.php?q=laptop
SOURCE=185.44.72.19 STATUS=200
Oct 05 09:23:02 WEB GET /search.php?q=' OR '1'='1
SOURCE=185.44.72.19 STATUS=400
Oct 05 09:23:04 WEB GET /search.php?q=' UNION SELECT username,password
SOURCE=185.44.72.19 STATUS=400
Oct 05 09:23:08 WEB GET /search.php?q='; DROP TABLE students;--
SOURCE=185.44.72.19 STATUS=400
Oct 05 09:23:15 SRC=185.44.72.19 DST=10.10.20.15
PROTO=TCP DPT=3306 ACTION=BLOCK
Oct 05 09:24:02 SRC=192.168.10.42 DST=10.10.20.15
PROTO=TCP DPT=443 ACTION=ACCEPT
Oct 05 09:25:18 SRC=10.10.20.15 DST=192.168.10.53
PROTO=UDP DPT=53 ACTION=ACCEPT
Question 1
Question 1
Which activity provides the strongest evidence that an attack is being attempted?
A. Multiple internal computers connect to port 443.
B. 192.168.10.8 connects to port 22.
C. 185.44.72.19 submits specially constructed input to the search page.
D. The server sends UDP traffic to port 53.
Question 2
Question 2
What type of attack is most strongly indicated by the evidence?
A. Cross-site scripting
B. SQL injection
C. DNS cache poisoning
D. SSH brute-force attack
Explain the specific evidence that supports your answer.
Question 3
Question 3
At 09:23:15, the firewall blocks a connection from 185.44.72.19.
Why is this event particularly significant when considered together with the earlier web activity?
A. Port 3306 is associated with MySQL, suggesting the same source may also be attempting direct access to the database service.
B. Port 3306 is associated with HTTPS, indicating the attacker changed websites.
C. The blocked connection proves that the SQL injection attack successfully modified the database.
D. The blocked connection indicates the server lost Internet access.
Question 4 — Evidence Analysis
Question 4 — Evidence Analysis
A student says:
"The firewall stopped the attack because it blocked 185.44.72.19."
Is that conclusion completely correct?
Explain your answer using at least TWO pieces of evidence from the log.
Question 5 — Security Recommendation
Question 5 — Security Recommendation
The administrator proposes this firewall change:
BLOCK all incoming traffic from the Internet to the server.
This would probably stop the suspicious external activity, but it would also prevent legitimate users from reaching the school's web service.
Recommend a more targeted security response that protects the server while preserving legitimate HTTPS access.
Your response must:
1. Identify what should be restricted or protected.
2. Identify at least one security control.
3. Explain why your solution is better than blocking all Internet traffic.
10-5-26
Objective: Students will be able to analyze a network by identifying devices and IP addresses, tracing network traffic, recognizing potential security risks, and recommending appropriate security controls to improve network security.
9-30-26
Objective: Students will be able to complete the cyber forge attack scenarios activity and upload screenshots of their results.
The CYBER//FORGE activity follows after the Network Builder.
It contains three attack-formulation missions:
Phishing Foothold — compromised employee workstation → internal file server.
DMZ Web Breach — Internet attacker → firewall → public web server in the DMZ.
Guest Network Pivot — attacker on Guest Wi-Fi attempts to cross the firewall into the trusted LAN.
For each mission, students must formulate:
Entry Point → Attack Method → Target → Network Path → Attacker Objective
Students also have to write a justification explaining their reasoning and identify a security control the attacker would need to overcome. Incorrect plans are rejected with guidance, hints cost points, and students must successfully complete all 3/3 scenarios.
Build a Network - Drag and Drop
9-30-26
Objective: Students will be able to identify different types of cyber threat actors and use evidence about their skills, motivations, targets, and actions to explain who is most likely responsible for a cyberattack.
Unit 3.2 Threat Actors & Adversaries
9-28-26
Objective: Students will be able to think like a Cybersecurity Professional and select/come up with the best responses to the questions/prompts.
3rd - Structure of a Cyber Attack (HOT) Part 2
Visual Example: https://drive.google.com/file/d/1dvnw5uIDTNHcYF5RKbciNeMXyK1ldkeL/view?usp=sharing
Example: https://drive.google.com/file/d/1TFYMxtrmypnI3nQdi9I9gG5YPVbTpjNJ/view?usp=sharing
9-23-26
Objective: Students will be able to think like a Cybersecurity Professional and select/come up with the best responses to the questions/prompts.
1st - Risk Management (Warm-Up)
2nd - Tools of the Hacking Trade (Getting Warmer)
3rd - Structure of a Cyber Attack (HOT)
Advice for Completing the Red Team Lab Online
Advice for Completing the Red Team Lab Online
Work from the same fictional network for the entire assignment. On Part 1, create your organization and network carefully. You will use that network for all ten missions. Your network needs multiple systems—including a firewall/router, web and DNS services, employee computers, servers, Wi-Fi, and IDS/IPS—so give yourself enough components to work with later.
Type directly into the answer boxes. You do not need to fill every box completely, but your answers should be specific enough to demonstrate that you understand the attack. Use complete thoughts rather than one- or two-word answers.
Use a consistent naming system. Give your fictional devices simple names such as WEB-SERVER, DNS-SERVER, EMPLOYEE-PC-1, FILE-SERVER, and ADMIN-PC. You can also assign fictional private IP addresses such as 10.0.10.5. This will make later missions much easier to explain.
For diagrams, keep them simple. You are not being graded on artistic ability. Show the direction of the attack with arrows. For example:
Attacker → Internet → Firewall → Web Server → Database
For a more complicated mission:
Compromised PC → File Server → Admin PC → Database Server
The worksheet specifically asks you to show systems, network paths, intermediate systems, and clearly labeled arrows.
Think in five steps for every mission: Target → Weakness → Attack Path → Intended Outcome → Evidence. If you can answer those five questions, you can complete almost every mission in the assignment.
For Evidence Left Behind, think like a cybersecurity investigator. Ask yourself: If this fictional attack happened, what would look unusual afterward? Possible answers could include failed logins, unusual network traffic, IDS/IPS alerts, unexpected account activity, changed files, strange DNS requests, or user reports. This is a recurring requirement throughout the missions.
Most importantly, this is a simulation only. Do not test any of these attacks against school computers, websites, Wi-Fi, accounts, or other real systems. The assignment is designed for you to demonstrate how an attacker might think without actually performing an attack.
Teacher tip: Save the PDF frequently.
9-21-26
Objective: Students will be able to analyze cybersecurity scenarios, system configurations, network logs, and security controls to identify threats, vulnerabilities, attack methods, and appropriate defenses while applying AP Cybersecurity concepts in preparation for the AP Cybersecurity Exam.
9-16-26
Objective: Students will be able to crack the secret password and open the folder.
https://www.programiz.com/javascript/online-compiler/
// Online Javascript Editor for free
// Write, Edit and Run your Javascript code using JS Online Compiler
console.log("Start small. Ship something.");// =====================================================
// AP CYBERSECURITY - TARGETED PASSWORD GUESSING LAB
// Safe classroom simulation: no real account is accessed.
// =====================================================
// The clue students already know:
const beginning = "Password";
// Small instructor-provided list of possible endings.
const possibleEndings = [
"Vikings",
"FWB",
"FWHS",
"FortWalton",
"FortWaltonBeach",
"FWBHS",
"BigGreen",
"2026"
];
// Hidden verification value for this classroom exercise.
// The actual password is not written here as plain text.
const expectedHash =
"b12ac561dcfa31e95604b852cd6cb8ced858b8af91e83d9ded005eaa10090cf6";
let attempts = 0;
// Helper function: converts a candidate into a SHA-256 digest.
async function sha256(text) {
const data = new TextEncoder().encode(text);
const digest = await crypto.subtle.digest("SHA-256", data);
return Array.from(new Uint8Array(digest))
.map(byte => byte.toString(16).padStart(2, "0"))
.join("");
}
// Main classroom simulation
async function runPasswordAudit() {
console.log("=== PASSWORD SECURITY LAB ===");
console.log("Known beginning: " + beginning);
console.log("");
// Loop through every instructor-provided ending.
for (let ending of possibleEndings) {
// Build the next candidate.
let guess = beginning + ending;
attempts++;
console.log(
"Attempt #" + attempts +
" | Testing: " + guess
);
// Convert this candidate to its comparison value.
let guessHash = await sha256(guess);
// If the values match, the candidate is correct.
if (guessHash === expectedHash) {
console.log("");
console.log("============================");
console.log("MATCH FOUND");
console.log("Candidate: " + guess);
console.log("Attempts required: " + attempts);
console.log("============================");
// Stop the loop after the match.
break;
}
}
}
runPasswordAudit();
9-14-26
Objective: Students will be able to analyze organizational cybersecurity risks and explain how security controls, policies, and defense-in-depth strategies reduce risk and protect the confidentiality, integrity, and availability of organizational assets.
9-10-26
Objective: Students will be able to identify how adversaries use AI-powered tools to augment cyberattacks and explain how AI makes attacks more effective, convincing, or difficult to detect.
For every scenario, students answer the same questions:
Cyberattack Analysis
Cyberattack Analysis
1. What is the attacker trying to accomplish?
2. How could this attack happen WITHOUT AI?
3. What limitation would the attacker have without AI?
4. Which AI Power-Up(s) are being used?
5. What new capability does AI give the attacker?
6. How does AI make the attack more effective?
7. What could the victim or organization do to recognize or defend against this attack?
Link to Red Team Blue Team Game
9-8-26
Objective: Student will be able to identify confidentiality, integrity, and availability risks in an organizational cybersecurity incident and justify an appropriate response.
9-3-26 continued
Objective: Student will be able to continue working on Capture the Flag (CTF) challenges. These engaging interactive cybersecurity challenges are designed to help learners apply technical skills in realistic problem-solving environments.
Link to Student Activity Packet
https://myap.collegeboard.org/login
8-31-26
Objective: Students will apply foundational cybersecurity principles—including risk management, cryptography, network security, and incident response—to analyze real-world technical scenarios and select the most effective security controls.
Here is the direct formula: ALE = SLE X ARO
ALE: Annualized Loss Expectancy
SLE: Single Loss Expectancy
ARO: Annualized Rate of Occurrence
https://forms.gle/FUMCiEYTQePnm7kT6
8-25-26 Continued
Objective: Students will be able to use basic Linux commands to navigate directories, create and examine files, search security records, and identify evidence of suspicious login activity in a simulated cybersecurity investigation.
8-24-26
Objective: Students will be able to explain how password hashing works, demonstrate how precomputed tables can be used to identify weak passwords, and describe how salting and modern password-hashing methods help protect stored credentials.
This is a good introductory Mac Terminal mini-lab, especially because these commands should not require administrator privileges when students are working inside their own home folders.
Here’s a sequence students can actually type.
1. Go to the Desktop
1. Go to the Desktop
cd ~/Desktop
Check where you are:
pwd
They should see something similar to:
/Users/studentname/Desktop
2. Create a directory
2. Create a directory
mkdir CyberLab
See that it was created:
ls
Then enter the directory:
cd CyberLab
3. Create a file
3. Create a file
touch secret.txt
Check:
ls
They should see:
secret.txt
4. Put information inside the file
4. Put information inside the file
Here's where it starts feeling more like a cybersecurity lab:
echo "This is my first cybersecurity file." > secret.txt
Display the contents:
cat secret.txt
Expected output:
This is my first cybersecurity file.
Add another line without erasing the first one:
echo "Unauthorized access prohibited." >> secret.txt
Then:
cat secret.txt
5. Create a SHA-256 hash of the file
5. Create a SHA-256 hash of the file
This is a great cybersecurity connection:
shasum -a 256 secret.txt
They'll get something like:
3f8a7c... secret.txt
Explain that the long value is the file's digital fingerprint. Change the file:
echo "The file has been modified." >> secret.txt
Hash it again:
shasum -a 256 secret.txt
The hash will be completely different. This gives you an easy introduction to file integrity.
6. Make a copy of the evidence
6. Make a copy of the evidence
cp secret.txt evidence.txt
Then:
ls
Now they'll have:
evidence.txt
secret.txt
Compare the files:
diff secret.txt evidence.txt
If nothing appears, the files are identical.
Now alter one:
echo "Evidence changed!" >> evidence.txt
Run:
diff secret.txt evidence.txt
Now Terminal identifies the difference.
7. Search a file like an investigator
7. Search a file like an investigator
grep "modified" secret.txt
Or:
grep "Evidence" evidence.txt
This introduces students to searching logs and other text-based evidence.
8. Create a hidden file
8. Create a hidden file
This one usually gets students' attention:
touch .hidden_file
Then:
ls
They won't see it.
Now:
ls -a
And suddenly:
.hidden_file
appears. This lets you explain that filenames beginning with . are normally hidden on Unix-like systems such as macOS.
9. A fun command — make the Mac talk
9. A fun command — make the Mac talk
On macOS:
say "Welcome to cybersecurity class"
Or:
say "Access granted"
That's usually an immediate hit in a classroom.
10. Finish by displaying everything
10. Finish by displaying everything
ls -la
This shows the files, hidden files, permissions, ownership, sizes, and other information.
You could turn this into a 30–40 minute Terminal Cybersecurity Lab where students have to complete each command, write down what happened, explain cd, mkdir, touch, echo, cat, cp, grep, shasum, and ls -la, and then answer a short section about hashing, hidden files, file integrity, and basic digital forensics.
That would move it beyond simply teaching Terminal commands and make it fit naturally into your cybersecurity instruction.
8-19-26 Continued
Objective: Students will be able to understand what social engineering is and recognize how attackers manipulate people rather than simply attacking technology.
8-17-26
Objective: Students will be able to understand what social engineering is and recognize how attackers manipulate people rather than simply attacking technology.
Bell Ringer - Read the intro to Cyber slides
An attacker manipulates a person into doing something that helps the attacker—revealing information, providing credentials, clicking a malicious link, downloading a malicious file, or otherwise granting access.
Concepts:
Social engineering — manipulating people to compromise security.
Phishing — fraudulent messages designed to make the victim click, download, log in, pay, or reveal information.
Elicitation — getting someone to reveal information, sometimes without realizing its importance.
Urgency — creating pressure such as “Act immediately” or “Your account will be closed.”
Intimidation/fear — threatening negative consequences to force action.
Impersonation/trust — pretending to be a teacher, administrator, IT technician, bank, company, friend, etc.
Suspicious links and attachments — understanding why clicking/downloading can compromise a device or credentials.
Credential harvesting — directing victims to fake login pages.
Sensitive information — passwords, authentication codes, personal information, security-question information, etc.
Consequences — account takeover, malware, impersonation, information theft, financial loss, and unauthorized access.
Defense — stop and verify independently rather than trusting the message itself.
8-13-26
Objective: Students will be able to identify common signs of a password attack.
Sign in https://centra.paradigmcyberventures.com/auth/sign-in
Directions
Write the letter of the correct description on the line beside each term. Use each letter once.
1. _____Nation-State Actors
2. _____Cyber Mercenaries
3. _____Organized Crime
4. _____Hacktivists
5. _____Script Kiddies
6. _____Corporate Competitor
7. _____Insider Threat
8. _____Cyber Pickpockets
9. _____Thrill-seekers
10. _____Cyber Terrorist
Descriptions
A. Individuals who use existing hacking tools or scripts, often with limited technical knowledge.
B. Attackers sponsored or directed by a government to conduct cyber operations against another nation, organization, or target.
C. A person inside an organization who may intentionally or accidentally misuse authorized access.
D. Criminal groups that use cyberattacks primarily to make money through fraud, theft, extortion, or other illegal activity.
E. Attackers motivated by a political, social, or ideological cause who use cyber activity to promote or defend that cause.
F. Highly skilled hackers or groups who perform cyber operations for paying clients.
G. An individual or organization seeking business advantage by stealing information, trade secrets, plans, or other competitive data.
H. Attackers who seek excitement, challenge, recognition, or entertainment rather than a major financial or political goal.
I. Attackers who steal small amounts of digital information, credentials, or financial data from individuals for personal gain.
J. Attackers who use cyberattacks to create fear, disruption, or serious harm in support of extremist or ideological objectives.
Page updated
Google Sites
Report abuse