Digital Defense Slides DIGITAL DEFENSE
Unit 01: Malware & Social Engineering
[SECURE_CONNECTION_ESTABLISHED]
The Digital Battlefield
Cybersecurity isn't just about computers; it's about protecting people, data, and systems.
Today's Objectives:
Identify major types of malware
Detect phishing and social engineering
Build a "Human Firewall" mindset
What is Malware?
"Short for Malicious Software."
Any code designed to damage, disrupt, or gain unauthorized access to a computer system.
Viruses
Needs a human to run/spread it.
Worms
Spreads automatically across networks.
Trojans
Disguised as useful software.
Social Engineering
Hacking the Human
The art of manipulating people into giving up confidential information or performing actions.
Exploits trust, fear, or urgency.
Easier than "brute-force" hacking.
The most common way data is stolen.
90%
of cyber attacks involve social engineering
Phishing 101
Attackers send fraudulent messages designed to trick you into revealing sensitive info (passwords, credit cards).
Spot the Red Flags:
Urgent or threatening language
Generic greetings (e.g., "Dear Customer")
Mismatched URLs or email addresses
Unexpected attachments
Inbox - SecureBank Support
From: security-update@s-ecurebank.com
URGENT: ACCOUNT BREACHED!
Your account has been accessed from a new device in Moscow. Click below to verify your identity immediately or your funds will be frozen.
SECURE MY ACCOUNT NOW
Can you find the red flags? 🚩
Your Digital Shield
Defensive Habits:
Use Multi-Factor Authentication (MFA)
Keep software updated
Hover before you click
When in doubt, verify through a separate channel
Stay Vigilant.
Cybersecurity is a team sport. Everyone plays a part in keeping the network safe.
Digital Defense Teacher Guide Digital Defense
Teacher Facilitation Guide
Lesson Time
60-90 Minutes
Lesson Overview
In this lesson, students will transition from passive users to proactive defenders of their digital lives. They will learn to identify the common "weapons" of cybercriminals (malware) and the "psychology" behind their attacks (social engineering and phishing).
Key Learning Objectives:
Define and distinguish between Viruses, Worms, and Trojans.
Identify common social engineering tactics used in phishing attacks.
Apply defensive strategies to analyze suspicious digital communications.
Required Materials
Digital Defense Slides
Threat Hunter Worksheets
Highlighters (2 colors)
Group scenario cards
Instructional Flow
1
Hook: The Unlocked Door (5-10 mins)
Ask: "If you left your front door unlocked, who is responsible if someone walks in? The person who entered, or you for leaving it open?" Discuss the idea that in cybersecurity, while the attacker is the criminal, the user provides the "unlocked door."
Pro-tip: Emphasize that "Human Error" is the cause of most breaches.
2
Malware Breakdown (15-20 mins)
Use Slides 3-4 . Use the biological analogy:
Virus: Like a cold—requires you to "shake hands" (run a file) to spread.Worm: Like a plague—spreads through the air (network) without any help.Trojan: Like a trap—looks like a gift but contains a threat.
3
The Human Hack (20 mins)
Use Slides 5-6 . Introduce Social Engineering. Perform a live "hover" demonstration on a link to show students how to check the actual destination URL.
Discussion Prompt:
"Why is it easier to trick a person than to hack a firewall?" (Answer: Empathy, fear, and curiosity are hard-wired into humans).
4
Active Practice: Threat Hunter (20-30 mins)
Distribute the Threat Hunter Worksheet . Students work in pairs to analyze the three scenarios. Encourage them to use highlighters: yellow for suspicious text, and orange for red flag markers (sender address, links).
Differentiation & Extension
For Advanced Learners
Ask students to research "Spear Phishing" vs. "Whaling." Have them create their own sophisticated phishing email and exchange it with a partner to see if the partner can find the "tells."
Support Strategies
Provide a "Red Flag Checklist" card that students can keep at their desks. Model the first scenario on the worksheet entirely before letting them work independently.
Cyber-Glossary
MFA (Multi-Factor Authentication)
Security that requires at least two forms of identification (e.g., password + code).
Social Engineering
Manipulating people into performing actions or divulging confidential info.
Payload
The part of the malware that performs the malicious action (e.g., deleting files).
Whaling
A highly targeted phishing attack aimed at high-profile individuals (CEOs, executives).
Threat Hunter Worksheet Threat Hunter
[ CLASSIFIED INVESTIGATION ]
Agent Name:
Date:
File 01: Malware Identification
Match the "digital biological" description to the correct malware classification.
A. I am a master of disguise. I look like a helpful software tool or a fun game, but once you let me in, I release my hidden malicious payload.
Enter Code
B. I am a lonely traveler. I don't need a host or a human to click anything. I find weaknesses in network pipes and crawl through them automatically.
Enter Code
C. I am a parasite. I attach myself to legitimate files. I can only move to a new computer if a person sends my host file via email or USB drive.
Enter Code
CODE: VIRUS
CODE: WORM
CODE: TROJAN
File 02: Evidence Analysis
Suspicious-Email-Log_082.eml
From: IT-Department-Support admin@updates-microsoft-secure.net
Subject: URGENT ACTION: Security Upgrade Required - Account Deletion Scheduled
Dear Valued User,
Our records show that your workstation is running an outdated security certificate. To prevent unauthorized access and potential account deletion, you must authenticate your credentials through our secure portal within the next 2 hours.
Failure to do so will result in an immediate permanent lockout for your protection.
CLICK HERE TO VERIFY IDENTITY
This is an automated system message. Do not reply.
Investigation Notes:
Identify three specific red flags in the email above and explain why they are suspicious.
1
2
3
File 03: Field Response
Scenario: The "Support" Call
You are working in the computer lab when your phone rings. The caller says they are from "Global Network Services" and they've detected a serious virus coming from your home computer. They offer to "fix it" for free if you download a small remote-access tool so they can scan your files. They sound very friendly and professional.
1. What specific type of attack is this?
2. What would be the safest way to handle this situation?
3. If you HAD downloaded the tool, what form of malware would it likely be classified as once it was on your system? Explain why. Threat Hunter Answer Key Threat Hunter
[ OFFICIAL ANSWER KEY ]
Document Reference:
KB-UNIT-01-KEY
File 01: Malware Identification
A. I am a master of disguise. I look like a helpful software tool or a fun game, but once you let me in, I release my hidden malicious payload.
TROJAN
B. I am a lonely traveler. I don't need a host or a human to click anything. I find weaknesses in network pipes and crawl through them automatically.
WORM
C. I am a parasite. I attach myself to legitimate files. I can only move to a new computer if a person sends my host file via email or USB drive.
VIRUS
File 02: Evidence Analysis
Investigation Notes (Possible Red Flags):
1
Sender Address:
The address admin@updates-microsoft-secure.net is not a legitimate Microsoft domain. Microsoft uses microsoft.com.
2
Urgency & Threats:
Language like "URGENT ACTION," "next 2 hours," and "permanent lockout" creates fear to rush the user into making a mistake.
3
Generic Greeting:
"Dear Valued User" is a generic placeholder. Authentic security alerts from major providers usually use your registered name.
4
Suspicious Link:
The email asks to "CLICK HERE TO VERIFY IDENTITY." IT departments rarely ask users to authenticate sensitive info through an email link.
File 03: Field Response
1. What specific type of attack is this?
Social Engineering / Technical Support Scam (Vishing).
Acceptable answers include "Phishing via phone" or "Voice Phishing."
2. What would be the safest way to handle this situation?
Hang up the phone immediately.
Do not download anything or provide any information. If concerned, contact the actual company through their official verified phone number or website.
3. If you HAD downloaded the tool, what form of malware would it likely be classified as once it was on your system? Explain why.
Trojan.
Because the software was disguised as a helpful, legitimate security tool to trick the user into installing it, but it actually contains a malicious "payload" (remote-access software).
