Defense Tactics Lesson Plan Digital Defense Tactics
Teacher Facilitation Guide
Duration
45 Mins
Learning Objectives
Construct logical firewall rules based on specific network security requirements and Zero Trust principles.
Develop a systematic plan to identify suspicious files, processes, and downloads.
Define implementation steps for recovering deleted files during an investigation.
Key Vocabulary
Zero Trust Ingress/Egress Least Privilege Process Tree File Hash Micro-segmentation
Materials Needed
Firewall Logic Worksheet
Threat Response Guide
Whiteboard/Markers
Projector for scenarios
Lesson Timeline
00-05m
Hook: The Breach Alert
Project a fake "System Alert" on the board. Tell students: "Our corporate web server is seeing 5,000 requests per second from an unknown IP in a foreign country. Our database is leaking records. What is your first move?"
Discussion Prompt: "In a crisis, why is a written 'Plan of Action' more important than just clicking buttons?"
05-15m
Direct Instruction: Zero Trust & Firewall Logic
Review the anatomy of a firewall rule: Action | Protocol | Source IP/Port | Destination IP/Port .
The Zero Trust Mindset: Explain "Never Trust, Always Verify." Every connection request is treated as a potential threat, even if it comes from inside the network.Explain "Default Deny" posture (whitelist vs. blacklist).
Demonstrate blocking a specific port (e.g., Port 22 for SSH) vs. allowing web traffic (Port 80/443).
15-35m
Activity: Hunt & Response Plan
Students work through the Threat Response Guide . They must outline specific steps for investigating three categories of threats:
Investigation A
Suspicious Processes (High CPU, random names)
Investigation B
Recent Downloads (Browser history, temp folders)
Investigation C
Deleted Artifacts (Recycle bin, slack space)
Teaching Tip: Connect Zero Trust to incident response. If we "never trust," how do we verify the identity of a running process or a newly downloaded file?
35-45m
Debrief: Defense Presentation
Ask three groups to share one "Implementation Step" from their plan. Critique the steps for specificity.
Exit Ticket Question
"In a Zero Trust architecture, why is it not enough to just verify a user's password once at login?"
Differentiation Strategies
Support
Provide a "Port Cheat Sheet" for the firewall activity so students don't have to memorize common ports (80, 443, 21, 22, 3389).
Extension
Challenge students to design a 'Micro-segmentation' plan for a small office network (separating Guest Wi-Fi from the Server VLAN).
Firewall Logic Worksheet Security Operations Center
Firewall Logic Scenarios
NAME: ____________________________________
Instruction Brief
Firewalls act as the first line of defense. Apply Zero Trust principles: assume every request is hostile until verified. Use the format: ACTION [Allow/Deny] | PROTOCOL [TCP/UDP/ICMP] | SOURCE IP : PORT | DESTINATION IP : PORT.
01 The Web Server Lockdown
PRIORITY: HIGH
Your company web server (192.168.1.50) needs to accept encrypted web traffic from the public Internet (0.0.0.0/0). It should not allow any other type of traffic.
Rule 1: Allow HTTPS Traffic
Rule 2: Deny All Remaining Ingress
02 Malicious IP Block
PRIORITY: CRITICAL
Threat intelligence reports that IP 203.0.113.42 is a known Command & Control (C2) server. Ensure no device in your internal network (10.0.0.0/24) can communicate with it on any port.
Egress Prevention Rule
03 Zero Trust Internal Access
PRIORITY: MED
In a Zero Trust network, we don't trust internal traffic. The Finance Team workstation (10.0.0.22) needs to access the Payroll Database (10.0.5.100) using a secure SQL connection (Port 1433).
Micro-segmentation Access Rule
Zero Trust Check
Traditional security uses a "Perimeter" defense (like a castle wall). How does Zero Trust change this approach when a user is already inside the building?
Threat Response Guide Project IR Protocol 404
Threat Response Guide
"Speed is vital, but precision is lethal. Develop your plan of action to neutralize the threat."
CLASSIFIED DOCUMENT
Your Objective
Create a step-by-step Plan of Action for a junior analyst to follow. Apply Zero Trust principles: never trust the system state, always verify every artifact.
Part 1: Process Hunting
IDENTIFY
The CPU is spiking at 95% usage. In a Zero Trust environment, we don't trust process names (like 'svchost.exe'). Outline three verification steps.
STEP 01
STEP 02
STEP 03
Part 2: Downloads
TRACE
How do we verify a file's integrity before running it?
Verification Artifact (e.g. Hash)
Implementation Step
Part 3: Deleted Files
RECOVER
An attacker tried to hide their tracks. How do you find what was lost?
Forensic Method
Implementation Step
Zero Trust Plan of Action
Explain how the "Never Trust, Always Verify" mindset changes your response compared to just trusting that internal tools are safe.
Defense Tactics Answer Key Answer Key & Reference
Digital Defense Tactics / Teacher Resource
INTERNAL USE ONLY
Firewall Logic Worksheet Key
Scenario 01: Web Server Lockdown
Rule 1: ALLOW | TCP | 0.0.0.0/0 : ANY | 192.168.1.50 : 443
Rule 2: DENY | ANY | ANY : ANY | 192.168.1.50 : ANY
Scenario 02: Malicious IP Block
Egress Rule: DENY | ANY | 10.0.0.0/24 : ANY | 203.0.113.42 : ANY
Scenario 03: Zero Trust Internal Access
Rule: ALLOW | TCP | 10.0.0.22 : ANY | 10.0.5.100 : 1433
*Note: In Zero Trust, internal lateral movement is restricted. Only the specific finance IP can reach the database port.*
Threat Response Model Answers
Suspicious Processes (Verification)
Check digital signatures to verify the publisher.
Compare file hashes against known good/bad lists (VirusTotal).
Analyze parent-child process relationships (e.g., should Word open PowerShell?).
File Verification
Calculate MD5/SHA256 hashes immediately upon discovery.
Check browser history/logs for the source URL of the download.
Sandboxing: Execute in an isolated environment to observe behavior.
Zero Trust Reflection Answer
"Traditional security assumes anyone inside the network is 'safe'. Zero Trust removes this assumption. Even if a user is logged in on a trusted device, every single request to access a resource (a file, a database, a server) is individually authenticated and authorized. Castle defense is 'trust but verify' at the gate; Zero Trust is 'never trust, always verify' at every door inside the castle."
