Cybersecurity and Online Safety

Learning Objectives

• Define cybersecurity and explain why it matters.
• Identify common online threats and types of malware.
• Describe phishing and how to avoid it.
• Apply strong passwords, two factor authentication and safe browsing.

What is Cybersecurity

Cybersecurity is the practice of protecting computers, networks, programs and data from unauthorised access, damage or attack. Almost everything we do online involves personal data, so every internet user needs basic cybersecurity knowledge.

Just as you lock the door of your house, you must protect your digital life with strong passwords, careful habits and awareness of online threats.

Common Online Threats and Malware

Malware is short for malicious software. It is any program written to harm a computer or steal data. A virus attaches itself to a program and spreads when that program runs. A worm spreads across a network on its own. A Trojan horse pretends to be a useful program so that a user installs it. Ransomware locks files and demands payment to unlock them. Spyware watches what you do and steals information.

Malware can enter a computer through suspicious downloads, infected flash drives, harmful links or unsafe websites. Antivirus software and regular system updates are important defences.

Phishing

Phishing is a scam in which a person pretends to be a trusted organisation, such as a bank or school, to trick you into giving away personal information. Phishing messages often create a sense of urgency, such as saying an account will be closed or that you have won a prize.

Signs of phishing include threatening or urgent language, a strange sender address, a greeting such as Dear customer instead of your name, links to unknown websites and requests for passwords or bank details. Do not click any links, do not reply, check the source and report the message to a trusted adult.

Identity theft means using stolen personal details to pretend to be someone else.

Strong Passwords and Two Factor Authentication

A strong password is long and mixes capital letters, small letters, numbers and symbols. It should not be a common word, a name or a date of birth. Do not reuse the same password on different sites, because if one account is stolen the others stay safe with different passwords. A passphrase, such as I#Love_Science2026, is strong and easy to remember.

Two factor authentication, or 2FA, requires a second proof of identity after the password, such as a code sent to the phone. Even if a password is stolen, the account stays safe without the second code.

Safe Browsing and Protecting Personal Information

Safe browsing means checking that a website uses https and shows a padlock before entering any personal information, keeping the browser updated and not downloading files from unknown sources.

Personal information includes your full name, address, phone number, school and bank details. It is valuable to criminals, so use a nickname online, keep profiles private and never share passwords or bank details on untrusted websites.

Social Media Safety and What To Do

Social media has privacy settings that control who sees your posts, profile and location. Review these settings and keep them strict, never accept requests from strangers and do not post your location in real time.

When something online feels wrong, trust your instincts. Do not click, do not share and tell a trusted adult. Report suspicious messages, block strangers, and if a link was clicked by mistake, run an antivirus scan and change your passwords.

Practical Work

1. Create a strong password for a sample account and explain why it is strong.
2. Turn on two factor authentication on a school or personal account if allowed.
3. List five signs that an email may be a phishing attempt.
4. Write five protection measures on a chart for the computer lab.

Scenario-Based Questions

1. Chidi receives an email from his bank asking him to click a link and enter his account number. The email was sent to his personal address, not his bank address. Using phishing, explain why it is suspicious and what he should do.
2. The school computers suddenly run very slowly and pop-ups appear. The teacher says malware is responsible. Explain which type could be responsible and how it entered the system.
3. Amina uses the same password, 123456, for her school portal, email and social media, while Tunde uses a different strong password for each. Compare their approaches and explain why Tunde is safer.
4. Bola notices the address bar shows a padlock and starts with https. Explain what these mean and why they matter.
5. Kemi downloads a free game from an unknown site and her photos later appear online. Identify the malware and explain how it got onto her computer.
6. A school plans a cybersecurity programme. List three rules it should teach students.
7. Emeka is asked for his home address and phone number before viewing an article. Explain what he should do and why sharing on unknown sites is risky.

Lesson objectives

By the end of the week, learners should be able to:

1. Name five common threats such as phishing, malware and password guessing.
2. State the protection for each threat.
3. Judge whether a given source is reliable by checking author, date and organisation.
4. Use two-factor authentication on at least one account.
5. Report a suspicious email message to the teacher.

Key vocabulary

• Cybersecurity: protecting systems, data and networks from attack.
• Threat: anything that can harm a computer system or user.
• Phishing: a fake message tricking a user into revealing credentials.
• Malware: malicious software installed without permission.
• Password guessing: attempting to crack a password by trial or brute force.
• Two-factor authentication: a second verification step after the password.
• Reliability check: judging a source by author, date and organisation.

Common misconceptions

• "Only adults need to worry about cybersecurity." Learners send emails and browse regularly and face the same threats.
• "A strong password stops everyone." Strong passwords help but phishing and malware bypass strength.
• "Reporting a suspicious email makes no difference." Reporting helps staff block threats schoolwide.

Teacher activities

1. Starter: display two emails, one genuine and one clearly fake; ask which looks more trustworthy.
2. Name five threats and pair each with a protection rule.
3. Demonstrate a reliability check on two sources and mark the trustworthiness.
4. Show two-factor authentication and activate it on a test account.
5. Give learners a suspicious email scenario and ask them to report it.
6. Close with the exit question comparing phishing with malware.

Student activities

1. Choose the more trustworthy email from the starter and explain the reason.
2. Name five threats and state the protection for each.
3. Apply a reliability check to two sources and mark each as reliable or not with a reason.
4. Turn on two-factor authentication on a test account and confirm the setup.
5. Decide whether a suspicious email is phishing and write the report action.
6. Answer the exit question in one sentence about phishing versus malware.

Practical / learning evidence

A five-threat-with-protection chart, a two-source reliability checklist and a one-page incident-report form. Submit all three for marking.

Resources and preparation

Printed threat cards, blank reliability checklist and an incident-report template. A test account with two-factor authentication enabled for demonstration. Disable camera capture during the demo.

Assessment for learning

Inspect the threat chart for five distinct threats with matched protections. Mark the reliability checklist for correct author, date and organisation checks. Check the incident report for a clear phishing judgement and action. Record any learner who dismisses suspicious emails.

Inclusion and homework

Provide the threat cards with matched protection labels preprinted for learners who need scaffolding. Allow oral completion of the reliability checklist. Extend confident learners with a four-threat extension list. Homework: enable two-factor authentication on one account you use regularly.