Students sort incidents at fictional club apps into software, user and supply-chain weaknesses with the fix for each, then review the Coding Club's own app (AC9TDI10P13 node 2). Descriptive and defensive throughout. A 5E mission lesson.
Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.
SlidesDownload Present from the browser, or export to PowerPoint or PDF.
WorksheetDownload Print the student copy; the Teacher edition has the answers.
Students will be able to
I can describe software, user and supply-chain weaknesses.
I can match each kind to a fix.
I can spot each kind in a system before it goes wrong.
Timing
Engage and Explore 10 min · Explain 10 min · Elaborate 18 min · Evaluate 7 min
Before class
Try the board yourself. The clubs and incidents are made up.
The one idea: weaknesses come from the app's own code, from people, and from what the app relies on; each needs its own fix.
This lesson stays descriptive and defensive: what each kind is and how it is fixed. Node 3 (exploring a vulnerability in the student's own software) is left to class, with the teacher, on the students' own projects.
Wider: news reports of real breaches can be sorted into the three kinds. Choose the reports yourself.
Running the lesson
Engage: ask who was at fault in each of the hook's three stories.
Explore: ask which incident was hardest to place, and why.
Explain: model naming the kind and the fix for one incident.
Elaborate: ask why the lookalike library name is supply chain and not user.
Evaluate: discuss what the school should do about the old maps library.
The hard part (on purpose)
Students call every incident software because it happened in an app. Ask: whose action, or whose code, was the weak part?
When students get stuck
What you will see
A question to ask
The fix
A student thinks bug-free code means safe (Sam's mistake).
Could a shared password let someone in, even with perfect code?
Code is one kind of weakness of three.
A student puts the lookalike library under User.
What did the app end up relying on?
Something it relies on went bad: supply chain.
Answers to the checks
Engage: whose fault?: A club's programmers test every line of their app's code and find no bugs. Is the app safe? Not necessarily. A shared password or a bad add-on lets someone in however good the club's own code is.
Explore: three incidents: Where was each weakness: in the app's own code, in what a person did, or in something the app relies on?
The missed update is software, the password given away is user, the changed add-on is supply chain.
Explain: three kinds: Sam's team checks their app. Click the line where it first goes wrong. line 3 Line 3: their own code is only one kind of weakness. People and add-ons can still let someone in, so they still need MFA and updates.
Elaborate: six incidents: Sort all six incidents and choose the fix that would have stopped each one.
Software: the missed update and the unchecked long name. User: the phone call and password1. Supply chain: the changed add-on and the lookalike library name.
Elaborate: our own app: Your review of the club app found three weaknesses. Name each kind and its fix.
Unchecked input is software, the shared sticky-note password is user, the unchecked add-on is supply chain. Fixing them now is cheaper than after an incident.
The maps library: A school app uses a free maps library. The library's makers stop updating it. What kind of weakness is growing? Supply chain The app relies on it. Replace it with a maintained one, or plan to.
Solutions
One possible solution for each task. Other correct programs are fine.
Elaborate: six incidents
Open task: any program that does what the step asks.
Elaborate: our own app
Open task: any program that does what the step asks.
Stretch and support
Stretch: Find a news report of a real breach and sort its causes into the three kinds.
Support: A card with the three kinds, an example and a fix for each.
Exit ticket
Name the three kinds of weakness with one fix for each.
Software (test and update the code), user (training, strong passwords, MFA), supply chain (check and update what you rely on).
What each step is for
Engage: whose fault?: Committing to whether bug-free code is enough tests the new move: weaknesses also come from people and from what an app relies on.
Explore: three incidents: Students sort three incidents by where the weakness was and find the three kinds by contrast.
Explain: three kinds: The teacher models naming the kind and its fix for each incident. Sam trusts bug-free code, the misconception planted after the method.
Elaborate: six incidents: One change: more incidents, and now the fix as well as the kind.
Elaborate: our own app: Applying the kinds to a new system: the club's own app, before anything has gone wrong.