You are the security officer for the Coding Club's new app. Years 7–8: why passwords fail, how a second factor protects an account, spotting phishing, and keeping a digital footprint small. Years 9–10: a threat model of the app, the three kinds of weakness, and the Australian Privacy Principles. Then a security review: find and fix every weakness to earn the flags. Everything is defensive and fictional.
Each lesson works two ways. Students can work through the online tutorial at their own pace (it checks their answers and saves their progress in their browser), or you can teach it to the whole class from the slides, then send students into the tutorial for the Modify and Make steps.
Every lesson guide has plain-language notes, the answers to every check, a solution for every task, and slides and a worksheet for Waypoints Prepare. These guide pages are not linked from student pages, but they are not secret either: keep printed Teacher editions for answers you do not want students to find.
Whole-course cheat sheet: Open to print (every command, grouped by unit: a handout for the final challenge)
Years 7–8: passwords, second factors, phishing and your digital footprint.
Passwords fail in predictable ways: sites leak their password lists, people reuse one password everywhere (so one leak opens every account), and common or personal passwords are on the lists people try first. Long passphrases (four random words), a different one for every site, kept in a password manager, fix most of it.
Multi-factor authentication (MFA) adds something you have (a phone, a security key) or are (a fingerprint) to something you know. A leaked password alone is no longer enough. Codes can still be tricked out of people by a fake sign-in page; a security key only answers the real site.
Phishing messages pretend to be someone you trust to get a password, money or a click. The signs: a sender address that isn't quite right, pressure or a deadline, a request for a password or payment, and a link whose text and destination differ. When unsure, go to the site or person yourself.
Your digital footprint is the data systems collect about you. A system should collect only what its purpose needs; settings such as location sharing and public profiles add to it.
Students are the Coding Club's security officer. Every person, address and app is made up; addresses use the example domains kept for examples.
Security and privacy (Years 9–10) covers hashing, keys and access control; Secret messages (Code) builds ciphers.
breach, reuse, passphrase, password manager, multi-factor authentication, security key, phishing, digital footprint.
Cheat sheet: Open to print (A4, with board pictures) · Markdown
Years 9–10: threat models, kinds of weakness and the Australian Privacy Principles.
A threat model starts with a data-flow diagram: where data moves (from a browser to an app), where it is stored (a database) and who can change it (an admin). At each point, ask what could go wrong (read on the way, copied from storage, used by the wrong person) and pick the defence that fits (HTTPS, hashing and encryption, access control and MFA).
Weaknesses come in three kinds: software (flaws in code, fixed by updating and testing), user (people tricked or weak passwords, reduced by training, strong passwords and MFA) and supply chain (something the app relies on, such as an add-on or library, goes bad; reduced by checking and updating what you depend on). These lessons describe weaknesses and how to fix them; they do not practise attacks.
The Australian Privacy Principles (in the Privacy Act 1988) say how organisations covered by the Act must handle personal information: collect only what is needed (APP 3), tell people what and why (APP 5), use it only for that purpose unless they agree (APP 6), keep it secure (APP 11) and let people see and correct it (APP 12). Even when a small club isn't legally covered, they are good practice.
threat model, data-flow diagram, vulnerability, software, user and supply chain weaknesses, patch, Australian Privacy Principles, personal information.
Cheat sheet: Open to print (A4, with board pictures) · Markdown
Inspect the club app, fix every weakness, collect the flags.
Cheat sheet: Open to print (A4, with board pictures) · Markdown