Packet Peek Slides PACKET PEEK
Understanding the inherent risks of an open internet architecture.
UNIT: INTERNET LOCKDOWN | LESSON 01
The Postcard Problem
Imagine sending a secret message on a postcard.
The mailman can read it.
The sorting machine operator can read it.
Anyone who touches it along the way can see everything.
STAMP
Meet me at the lockers after school. The code is 12-34-56.
UNENCRYPTED: VISIBLE TO ALL
What is a Packet?
Data on the internet isn't sent as one giant file. It is broken into small chunks called Packets.
PACKET 1/3
To: 192.168.1.1
From: 10.0.0.45
"Dear Bob, I..."
PACKET 2/3
To: 192.168.1.1
From: 10.0.0.45
"...wanted to tell..."
PACKET 3/3
To: 192.168.1.1
From: 10.0.0.45
"...you the secret."
Each packet contains a "Header" (like the address on an envelope) and the "Payload" (the actual content).
Man-in-the-Middle (MITM)
ALICE
Sender
MALLORY
The Interceptor
BOB
Receiver
In a MITM attack, the attacker intercepts the message. They can read it or even change it before Bob ever sees it.
Where is the Risk?
Public Wi-Fi
Open networks (like at coffee shops or airports) allow anyone on the same network to potentially "sniff" your traffic.
Routers & Switches
Your data passes through dozens of computers owned by different companies. Any one of them could be compromised.
ISP (Internet Service Provider)
The company you pay for internet can technically see every unencrypted packet you send.
Malicious Actors
Hackers can set up "Fake Hotspots" with names like FREE_WIFI_HERE to trick you.
Mission Objective
If the Internet is naturally OPEN...
How can we ever send anything private?
NEXT MISSION: INTRODUCTION TO CRYPTOGRAPHY
Packet Interceptor Worksheet The Interceptor Lab
Lesson 01: Open Internet Risks & MITM Simulations
LAB_ID: L1-MITM-001
SEC_LEVEL: UNCLASSIFIED
Student Name:
Date:
Part 1: The Postcard Simulation
During the classroom activity, a "secret" was passed from one side of the room to the other using an unencrypted postcard. Reflect on the process below.
1. How many students touched the postcard before it reached its final destination?
2. Did any of the "intermediary" students (the people passing the note) read the message? How do you know?
3. In this simulation, what represented the "Internet Routers"?
Part 2: Packet Anatomy
Below is a mock-up of a data packet being sent across a network. Label the three main parts using the word bank.
[ PAYLOAD ] [ IP HEADER ] [ SEQUENCE NUMBER ]
FROM: 172.16.254.1 | TO: 8.8.8.8
Packet 4 of 12
Content Area
Part 3: Vulnerability Assessment
Scenario: Public Wi-Fi Coffee Shop
You are logged into the "Coffee_Guest" Wi-Fi. You type your password into a website that does NOT use encryption. Describe how an attacker on the same network could steal your password.
Critical Thinking: Modification
The "Man-in-the-Middle" doesn't just read messages; they can change them. If Alice sends Bob a message saying "Transfer $50 to my account," how could an interceptor maliciously change this packet?
SECURE THE NET
Network Risk Guide Network Risk Guide
Teacher Resource • Lesson 01
L1
Time Allotment
50 Minutes
Subject Focus
Network Architecture
Prep Level
Low (Paper/Pens)
Instructional Overview
This lesson sets the stage for the entire unit by establishing that the Internet is not secure by default. Students often assume that messages go directly from Device A to Device B. The goal is to shatter this illusion through physical simulation.
Key Objectives
Visualize the path of data packets through multiple nodes.
Understand the "Postcard Analogy" for unencrypted data.
Identify the "Man-in-the-Middle" vulnerability.
Vocabulary
- Packet Switching
- IP Address
- Router
- MITM Attack
Activity: The Postcard Simulation
1. Setup (5 mins)
Divide the class into "Sender," "Receiver," and "Routers." The Sender sits at the front-left, the Receiver at the back-right. All other students are Routers arranged in a grid-like pattern between them.
2. The Mission (15 mins)
The Sender writes a "secret code" (e.g., "The eagle flies at midnight" ) on a 3x5 index card. They must pass it to the Receiver, but there's a catch:
- You can only pass the card to someone sitting directly next to you.
- Every "Router" who touches the card is technically allowed to read it.
- The Twist: Secretly appoint 1-2 students as "Interceptors." Their goal is to write down the secret code on their own paper without stopping the flow of the card.
3. The Debrief (10 mins)
Discussion Prompts:
"To the Routers: If you saw the code, could you have changed it before passing it on? What would happen?"
"To the Receiver: Do you have any proof that the message you received is exactly what the Sender wrote?"
Common Misconceptions
"My message goes straight to my friend."
Reality: Most internet data passes through 10–20 different routers (nodes) before reaching its destination. Any one of those nodes can see unencrypted traffic.
"I'm on my home Wi-Fi, so I'm safe."
Reality: Even if your Wi-Fi is secure, once the data leaves your router and enters the public internet, it is exposed unless it is encrypted.
Cipher Secrets Slides CIPHER SECRETS
History, mechanics, and the vulnerabilities of symmetric encryption.
UNIT: INTERNET LOCKDOWN | LESSON 02
Cryptography
The art of scrambling a message so that only the sender and receiver can understand it.
WKH VHFUHW LV RXW
THE SECRET IS OUT
Plaintext
The original, readable message.
Ciphertext
The scrambled, unreadable message.
Key
The secret info needed to lock/unlock the message.
The Caesar Cipher
One of the earliest known ciphers. It works by shifting the alphabet by a certain number of places.
SHIFT KEY: +3
Substitution Cipher
Original:
A B C D E
Ciphered:
D E F G H
Symmetric Encryption
"The Same Key is used to both lock (encrypt) and unlock (decrypt) the message."
Just like a physical front door key. If you have the key, you have total access.
Master Key
The Fatal Flaw
How do you share the secret key with your friend without an attacker stealing it?
The Distribution Problem
If Alice and Bob are miles apart, they must send the key through the (insecure) internet.
The MITM Interception
If Mallory intercepts the KEY, she can read every message Alice ever sends to Bob.
MISSION: CRACK THE CODE
Open your "Crack the Code" activity sheet.
Shift it
Keep it Secret
Decrypt it
Crack the Code Worksheet Crack the Code
Lesson 02: Introduction to Symmetric Cryptography
ENCRYPTION LEVEL: LOW
Student Name:
Key Holder ID:
Part 1: The Caesar Tool
Use this reference table to help you calculate your shifts. In a Caesar Cipher, you shift the alphabet by a fixed number of positions (the key).
P
A
B
C
D
E
F
G
H
I
J
K
L
C (+1)
B
C
D
E
F
G
H
I
J
K
L
M
*P = Plaintext | C = Ciphertext
Task A: Encrypt the Message
Key: Shift +3 (A → D, B → E, etc.)
PLAINTEXT: C O M P U T E R
CIPHERTEXT:
Task B: Decrypt the Message
Key: Shift +5 (To decrypt, go BACKWARDS 5 spots!)
CIPHERTEXT: R N X X N T S
PLAINTEXT:
Part 2: Symmetric Analysis
1. The Distribution Problem
You and a friend want to use a Caesar Cipher to send secret notes in the hallway. You decide on a key of +12. How do you tell your friend the key (+12) without anyone else hearing or seeing it?
2. The "Key Theft" Scenario
If an attacker (like Mallory) steals your shift number (the key), can she read all your future messages? Why or why not?
Critical Challenge
Modern computers can try millions of shift keys in less than a second (this is called "Brute Force"). Is the Caesar Cipher strong enough to protect your bank password today? Explain your reasoning.
Cryptography Teacher Guide Cryptography Teacher Guide
Lessons 02 & 03 • Symmetric & Asymmetric
Keys
Key Concepts
Symmetric Ciphers, Key Management, Asymmetric Pairs, Lockbox Analogy.
Activity Prep
Worksheets printed, optional 3x5 cards for public directory.
Lesson 02: Caesar Cipher Guidance
Activity: Crack the Code
Students often struggle with "backwards" shifting for decryption. Remind them that if the key is +5, they must count 5 steps left on the alphabet to decrypt.
Task A Answer (Shift +3):
F R P S X W H U
Task B Answer (Shift +5 Decrypt):
M I S S I N G
Teaching Tip
When discussing the "Fatal Flaw," ask students how they could send a key to a friend in China. This highlights that physical distance makes symmetric key exchange nearly impossible on a global internet.
Lesson 03: Asymmetric Simulation
The Public Directory Setup
The simulation worksheet gives every student a default key of +14 / -14. To make it more realistic, you can assign different shift numbers to different rows of students.
Simulation Script
1 Announce Public Keys: Have students stand up and say their "Public Shift." Everyone else writes it in their directory.
2 Send Message: Alice wants to send "HELLO" to Bob. Alice looks at Bob's Public Key (+5) and encrypts it to "MJQQT".
3 Decrypt: Bob receives "MJQQT". He uses his Private Key (-5) to get back to "HELLO".
Worksheet Answer Key (Part 3)
Message received: G S Q F S H (Encrypted with +14)
DECRYPTED: S E C R E T
Critical Synthesis Question
"If Asymmetric encryption is so good, why do we still use symmetric encryption for large files?"
Teacher Answer: Asymmetric encryption involves complex math and is very "heavy" (slow). In the real world, we use Asymmetric encryption to securely share a Symmetric key, then use that Symmetric key for the rest of the conversation because it is much faster.
Public Key Puzzle Slides THE LOCKBOX PROBLEM
Solving the key distribution dilemma with Asymmetric Encryption.
UNIT: INTERNET LOCKDOWN | LESSON 03
The Problem
How can two people who have never met before communicate securely over the internet?
If they send a symmetric key (like +3), an attacker will just steal the key.
The Lockbox Analogy
Phase 1: Public Key
Bob sends Alice an Open Padlock. Anyone can see it, but only Bob has the key to close it.
Phase 2: Private Key
Alice puts her message in a box and snaps the lock shut. She sends the locked box back to Bob.
Two Keys, Not One
Public Key
Used to Encrypt (lock) data. Shared with the world.
ssh-rsa AAAAB3NzaC1yc2EA...
Private Key
Used to Decrypt (unlock) data. NEVER SHARED.
-----BEGIN RSA PRIVATE KEY-----
Asymmetric in Action
This is what happens every time you see the Padlock Icon in your browser (HTTPS).
Google sends you their Public Key.
Your browser encrypts your info with it.
ONLY Google can unlock it with their Private Key.
https://accounts.google.com
CHALLENGE: THE KEY EXCHANGE
If you have the PUBLIC KEY of every person in the room...
Can you send a private message to just ONE person without a pre-shared secret?
Key Exchange Simulation Activity Public Key Simulation
Lesson 03: The Lockbox Solution
AUTH_PROTOCOL: RSA-2048
KEY_PAIR: ASYMMETRIC
Part 1: Your Key Pair
My Public Key
(Share this with everyone!)
SHIFT: +14
Top Secret
My Private Key
(NEVER show this to anyone!)
SHIFT: -14
Part 2: The Public Directory
Record the Public Keys (shifts) of 4 classmates below. You will use these to send them messages.
Classmate Name Their Public Key (Shift)
Part 3: Transmission Log
Task: Encrypt a message for a classmate.
Recipient: ________________
Their Public Key: __________
PLAINTEXT: S E C R E T
Encrypted Message:
Decrypting a message sent to YOU:
Someone just sent you a message encrypted with YOUR public key (+14). To read it, you must use YOUR private key (-14).
CIPHERTEXT: G S Q F S H
Decrypted Plaintext:
Think Like a Hacker:
Mallory intercepts the "Public Key Directory" and sees everyone's public key. Can she use that directory to read the messages Alice sends to Bob? Why or why not?
Verified Trust Slides VERIFIED TRUST
Understanding Digital Certificates and the role of Certificate Authorities.
UNIT: INTERNET LOCKDOWN | LESSON 04
The Imposter Problem
Asymmetric encryption lets us lock boxes... but how do we know WHO sent us the lock?
Mallory sends Alice a lock, claiming to be Google.com.
Alice locks her password in the box and sends it to Mallory.
Certificate Authorities
A CA is a trusted "Third Party" that verifies identity.
"It's like a Digital Passport Office."
They check the website's legal papers and then issue a Digital Certificate.
Identity Verified
Subject:
*.google.com
Issued By:
DigiCert Global CA
Public Key:
DIGITALLY SIGNED
The Padlock Icon
When your browser sees a valid certificate from a trusted CA, it shows the Padlock.
https://mybank.com
Encryption
Data is private
Identity
Site is verified
Integrity
Data hasn't changed
HTTPS vs HTTP
HTTP
HyperText Transfer Protocol
UNSECURE - NO ENCRYPTION
"Like a postcard in the mail."
HTTPS
HTTP SECURE (over SSL/TLS)
SECURE - FULLY ENCRYPTED
"Like an armored vault car."
MISSION: TRUST VERIFICATION
Open your browser and look for the padlock on your favorite site.
Can you find who verified the site?
The Trust Factor Worksheet The Trust Factor
Lesson 04: Certificates & Browser Security
SECURE_STATUS: VERIFIED
User:
Station ID:
Part 1: Padlock Inspection
Navigate to a few websites (e.g., your school site, Google, a news site) and click the padlock icon in the address bar.
Website URL:
Certificate Issued By:
Website URL:
Certificate Issued By:
1. Why does the browser need a "Certificate Authority" to issue these? Why can't the website just make their own?
Part 2: Phishing Alert
http://login.goog1e-verify.com/secure
Look closely at the URL and the protocol above.
Vulnerability 1:
Vulnerability 2:
2. If a site has the Padlock but the URL is spelled wrong (like "amaz0n.com"), is it safe? Explain.
The "S" in HTTPS
Explain what actually happens technicaly when your browser establishes a secure connection with a website like Amazon. Use the words: Public Key , Private Key , and Certificate .
Web Trust Teacher Guide Verified Trust Guide
Lessons 04 & 05 • Certificates & Modern Defense
Safe
Lesson 04: Digital Trust Guidance
Hands-On: Padlock Inspection
Students may need help finding the certificate details. In Chrome/Edge:
Click the Lock Icon → Connection is secure → Certificate is valid .
Look for "Issued By" (Common ones: DigiCert, Let's Encrypt, GlobalSign).
Phishing Analysis (Worksheet Part 2)
http://login.goog1e-verify.com/secure
Vulnerability 1: Uses HTTP (not HTTPS). Traffic is unencrypted.Vulnerability 2: Typo-squatting URL (goog1e instead of google).
Common Misconception
"If it has a padlock, it must be the real site."
Correction: Hackers can get valid certificates for fake domains (like amaz0n.com). The padlock only proves the connection is encrypted, not that the company is who you think they are.
Lesson 05: Future Proof Guidance
The Brute Force Demonstration
Use a site like Security.org's "How Secure Is My Password?" to show students real-time crack estimates during your slides.
Answer Key (Part 1):
- 123456: Instantly
- B@sketb@ll: ~2 hours
- Cloud-Desk-Table-88: ~4 quadrillion years
Discussion: The Encryption Debate
This is an open-ended ethical debate. Facilitate by assigning half the class to "Privacy First" and the other half to "Security First."
"If you make a backdoor for the 'good guys,' the 'bad guys' will find it eventually. In code, a door is a door."
Exit Ticket Challenge
"You are the CSO (Chief Security Officer) of a new social media app."
List three technical protocols you would implement to ensure that user messages can NEVER be read by anyone except the sender and receiver.
(Expected Answers: End-to-end Asymmetric encryption, MFA, HTTPS Certificate verification).
Future Proof Defense Slides FUTURE PROOF DEFENSE
Modern security strategies and the ethics of a private internet.
UNIT: INTERNET LOCKDOWN | LESSON 05
Brute Force Reality
Computers can guess millions of passwords per second. Length and complexity are your only protection.
"password" → Instantly
"P@ssw0rd123" → 3 Days
"PurpleMonkey!78" → 4,000 Years
Entropy Scale
"The longer the phrase, the harder the crack."
Beyond Passwords: MFA
Something You Know
Password, PIN, or Security Question.
Something You Have
Phone, Security Key, or Smart Card.
Something You Are
FaceID, Fingerprint, or Iris Scan.
MFA stops 99.9% of automated account hacks.
Privacy vs. Security
The Privacy Case
Strong encryption protects journalists, activists, and ordinary citizens from government surveillance and identity theft.
"Without privacy, there is no freedom."
The Security Case
Encryption can be used by criminals to hide illegal activities. Some argue for "Backdoors" so law enforcement can investigate crimes.
"If we can't see the data, we can't stop the crime."
FINAL MISSION: DEFENSE UPGRADE
Your digital life is only as strong as your WEAKEST link.
What will you change today?
The Password Challenge Worksheet Future Defense Lab
Lesson 05: Modern Security & Digital Ethics
TOP_SECRET
Agent:
Unit ID:
Part 1: Password Entropy
Estimate how long it would take a high-speed computer to guess these passwords using "Brute Force" (guessing every combination).
Password: 123456
Estimated Crack Time:
Password: B@sketb@ll
Estimated Crack Time:
Password: Cloud-Desk-Table-88
Estimated Crack Time:
Password: qwerty
Estimated Crack Time:
1. Why is a longer password (like "PurpleDogBlueChair") often stronger than a complex short one (like "P@ss1!")?
Part 2: MFA Designer
Multi-Factor Authentication (MFA) requires two or more forms of evidence. Design a 3-factor system for a high-security bank vault.
Something You Know
Something You Have
Something You Are
Part 3: The Big Debate
The Dilemma: Some governments want "Master Keys" (backdoors) to all encryption so they can catch criminals. Tech companies argue that a backdoor for the government is a backdoor for hackers too.
Your Position:
Is absolute privacy worth the risk of criminals using it for cover? Or is public safety worth the risk of less personal privacy? Explain.
Certified Secure
