ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities

1 What cyber security is 2 Why attackers target accounts and data 3 Confidentiality 4 Integrity 5 Availability 6 Asset 7 Threat 8 Vulnerability 9 Exploit 10 Threat actor 11 Attack surface 12 Accidental threats to data 13 Deliberate threats to data 14 Events-based threats to data 15 Insider threats and human error 16 Cyber security incident 17 Data breach 18 Impact of a cyber attack on an individual 19 Impact of a cyber attack on an organisation 20 Malware 21 Viruses 22 Worms 23 Trojan horse 24 Spyware 25 Adware 26 Ransomware 27 Social engineering 28 Phishing 29 Spear phishing 30 Smishing and vishing 31 Pretexting 32 Physical social engineering: tailgating and baiting 33 Pharming 34 Brute-force and dictionary attacks 35 Weak passwords 36 Interception of data on a network 37 Man-in-the-middle attacks 38 Risks of unsecured public Wi-Fi 39 Unauthorised network access 40 Denial of service attacks 41 Distributed denial of service (DDoS) attack 42 Matching a threat to its process and aim 43 Attackers using AI 44 What threat modelling is 45 Data flow diagram of a system 46 Trust boundaries 47 STRIDE threat categories 48 Mapping STRIDE threats to confidentiality, integrity and availability 49 Risk as likelihood and impact 50 Risk rating matrix 51 Writing a threat statement 52 Writing a threat model table 53 Attack trees 54 Reviewing and updating a threat model 55 Software vulnerabilities 56 Input validation 57 SQL injection 58 Cross-site scripting (XSS) 59 Buffer overflow 60 Zero-day vulnerabilities 61 Outdated versions of software 62 Default credentials and insecure settings 63 Improper credential management 64 Hard-coded API keys and secrets 65 Reading a vulnerability report 66 Patch management 67 Risks of password re-use 68 Spotting the signs of a phishing message 69 Checking links and fake websites 70 Oversharing fuels targeted attacks 71 Ask, Check, Think 72 Multi-factor authentication 73 Limits of MFA 74 Software supply chain 75 Third-party dependencies 76 Compromised software updates 77 Typosquatting and malicious packages 78 Analysing a real supply chain attack 79 Code signing and trusted sources 80 Software bill of materials (SBOM) 81 Reducing supply chain risk 82 Security controls: prevent, detect, respond 83 The principle of least privilege 84 Firewalls 85 Antivirus software 86 Keeping software updated 87 The Essential Eight 88 Choosing a solution to counter a threat 89 Layers of protection 90 Access logs and audit trails 91 Spotting an attack in a log file 92 Incident response: detect, contain, recover 93 Responding to a suspected compromise 94 Australian Privacy Principle 11 95 Applying protections to a scenario 96 Creating a cyber safety awareness message 97 Why data is encrypted 98 Encryption and decryption 99 Plaintext 100 Ciphertext 101 Encryption key 102 Encrypting a message with a Caesar shift 103 Wrapping around from Z to A 104 Decrypting a message with a Caesar shift 105 Using a cipher wheel or strip 106 Caesar cipher wrap-around with MOD 26 107 Key space: how many keys a cipher has 108 Breaking a Caesar cipher by trying every shift 109 Monoalphabetic substitution cipher 110 Frequency analysis 111 Building a frequency table with COUNTIF 112 Transposition cipher: rail fence 113 Polyalphabetic ciphers 114 Vigenere cipher 115 Why a Caesar cipher is weak compared with modern encryption 116 CODE and CHAR functions in a spreadsheet 117 The MOD function in a spreadsheet 118 Encrypting a letter with a Caesar formula in a spreadsheet 119 Decrypting a Caesar cipher in a spreadsheet 120 For Loops 121 ord() and chr() in Python 122 More Arithmetic 123 Testing letters with isalpha() and isupper() 124 Encrypting a message with a Caesar loop in Python 125 Decrypting a Caesar cipher in Python 126 Brute-forcing a Caesar cipher in Python 127 Vigenere cipher in Python 128 The XOR cipher 129 Base64 is encoding, not encryption 130 Keeping an encryption key secret 131 Why encrypted data is useless to an interceptor 132 Symmetric encryption 133 The risk of sharing a symmetric key 134 AES 135 One-way functions 136 Asymmetric encryption 137 Public key 138 Private key 139 Sending a secure message with asymmetric encryption 140 ECDH 141 RSA 142 Comparing symmetric and asymmetric keys 143 HTTPS and the padlock 144 SSL certificates and the handshake 145 Encrypting data at rest and in transit 146 Hashing functions 147 Hashing text with hashlib in Python 148 Using hashes to check data integrity 149 Why passwords are stored as hashes 150 Salting a password hash 151 Choosing a cryptographic technique for a scenario

19

ACARA 9-10 Digital Technologies: Cyber security foundations — AC9TDI10P13 Students learn the core vocabulary of cyber security, including the CIA triad, assets, threats, vulnerabilities and exploits, and how incidents and breaches affect individuals and organisations.

24

ACARA 9-10 Digital Technologies: Types of cyber security threats — AC9TDI10P13 Students investigate how malware, social engineering, password attacks, network interception and denial of service attacks work and what the attacker is trying to achieve.

11

ACARA 9-10 Digital Technologies: Modelling cyber security threats — AC9TDI10P13 Students develop threat models using data flow diagrams, trust boundaries, STRIDE, risk ratings, threat statements, threat tables and attack trees.

12

ACARA 9-10 Digital Technologies: Software vulnerabilities — AC9TDI10P13 Students explore how flaws and insecure settings in software, such as injection attacks, outdated versions and exposed secrets, are found, reported and patched.

7

ACARA 9-10 Digital Technologies: User vulnerabilities — AC9TDI10P13 Students learn how attackers exploit people through password re-use, phishing and oversharing, and how habits and multi-factor authentication reduce the risk.

8

ACARA 9-10 Digital Technologies: Software supply chain vulnerabilities — AC9TDI10P13 Students analyse how weaknesses in third-party code, updates and packages can reach many victims, and how supply chain risk is reduced.

15

ACARA 9-10 Digital Technologies: Protecting systems and responding to threats — AC9TDI10P13, AC9TDI10P14 Students choose and apply security controls, read logs for signs of attack, respond to incidents and consider the privacy obligations that protect personal information.

19

ACARA 9-10 Digital Technologies: Encryption and classical ciphers — AC9TDI10K01 Students learn how encryption works and practise encrypting, decrypting and breaking Caesar, substitution, rail fence and Vigenere ciphers by hand.

13

ACARA 9-10 Digital Technologies: Coding ciphers in spreadsheets and Python — AC9TDI10K01 Students build Caesar, Vigenere and XOR ciphers using spreadsheet formulas and Python code.

23

ACARA 9-10 Digital Technologies: Modern cryptography and hashing — AC9TDI10K01 Students compare symmetric and asymmetric encryption, see how HTTPS secures data and use hashing to check integrity and store passwords.

✎

Python Crossword: Control Flow (Modules 11–20) 10 clues · Type Conversion, Comparison Operators, Boolean Logic, If Statements and more

🔎

Python Word Search: Getting Started and Control Flow (Modules 1–20) 22 words to find · print() function, input() function, Comments, Variables and more

✎

VCE Cyber Security Crossword: Emerging trends in cyber security to Antivirus software (Modules 1–10) 10 clues · Emerging trends in cyber security, Regulatory compliance, Zero Trust Architecture, Routers and more

✎

VCE Cyber Security Crossword: Local Area Networks (LANs) to Viruses (Modules 21–30) 10 clues · Local Area Networks (LANs), Wide Area Networks (WANs), Wireless Personal Area Networks (WPANs), Global exposure to cyber security threats and more

✎

VCE Cyber Security Crossword: Worms to Operating system updates (Modules 31–40) 10 clues · Worms, Ransomware, Denial of service attacks, Improper credential management and more

✎

VCE Cyber Security Crossword: Software malware updates to RSA (Modules 41–50) 10 clues · Software malware updates, Staff procedures, Encryption and decryption, Caesar cipher and more

✎

VCE Cyber Security Crossword: ECDH to ISM guideline: network access controls (Modules 51–60) 10 clues · ECDH, ECDSA, Machine learning analysis of network traffic, Real-time monitoring and notification and more

✎

VCE Cyber Security Crossword: ISM guideline: confidentiality and integrity of wireless traffic and more (Modules 61–74) 10 clues · ISM guideline: confidentiality and integrity of wireless traffic, ISM guideline: wireless network footprint, Privacy Act 1988 (Cwlth), Australian Privacy Principle 1 and more

🔎

VCE Cyber Security Word Search: Emerging trends in cyber security and more (Modules 1–20) 20 words to find · Emerging trends in cyber security, Regulatory compliance, Zero Trust Architecture, Routers and more

🔎

VCE Cyber Security Word Search: Local Area Networks (LANs) to Operating system updates (Modules 21–40) 20 words to find · Local Area Networks (LANs), Wide Area Networks (WANs), Wireless Personal Area Networks (WPANs), Global exposure to cyber security threats and more

🔎

VCE Cyber Security Word Search: Software malware updates to Information Privacy Principle 5 (Modules 41–74) 22 words to find · Software malware updates, Staff procedures, Encryption and decryption, Caesar cipher and more

✎

Issues in Technology Crossword: Is AI using too much power? and more (Part 1 of 2) 10 clues · Is AI using too much power?, How does an AI actually work?, Compression - losing quality or saving space?, Why file size matters and more

🔎

Issues in Technology Word Search: Is AI using too much power? to What is RADCAB? (All modules) 22 words to find · Is AI using too much power?, How does an AI actually work?, Compression - losing quality or saving space?, Why file size matters and more

✎

Years 5–6 Digital Systems Crossword: Data and networks and Accounts, passphrases and security (Modules 41–52) 10 clues · Strong passwords, Passphrase, Risks of password re-use, Unique passphrase for each account and more

🔎

Years 5–6 Digital Systems Word Search: Data and networks and Accounts, passphrases and security (Modules 21–52) 20 words to find · Data transmission, Wired transmission, Wireless transmission, Bluetooth for short-range transfer and more

✎

Years 7–8 Digital Systems Crossword: Data transmission and network security and Account security and cyber threats (Modules 26–74) 10 clues · Comparing wired and wireless networks, Wi-Fi range and interference, HTTPS and the padlock, Securing a Wi-Fi network and more

🔎

Years 7–8 Digital Systems Word Search: Hardware for particular tasks to Account security and cyber threats (Modules 4–74) 20 words to find · CPU clock speed (GHz), CPU cores, HDD vs SSD performance, Storage units: KB, MB, GB, TB and more

✎

Years 9–10 Digital Systems Crossword: Controlling and securing access to data (Modules 13–24) 10 clues · Confidentiality, Integrity, Availability, Authentication vs authorisation and more

✎

Years 9–10 Digital Systems Crossword: Controlling and securing access to data and Threats and software vulnerabilities (Modules 25–40) 10 clues · Salting a password hash, Brute-force and dictionary attacks, Asset, Threat and more

✎

Years 9–10 Digital Systems Crossword: Threats and software vulnerabilities to Software supply chain vulnerabilities (Modules 41–69) 10 clues · SQL injection, Buffer overflow, Zero-day vulnerabilities, Insider threats and human error and more

✎

Years 9–10 Digital Systems Crossword: Software supply chain vulnerabilities and Threat modelling and security responses (Modules 70–79) 10 clues · Reducing supply chain risk, Risk as likelihood and impact, Risk rating matrix, Data flow diagram of a system and more

🔎

Years 9–10 Digital Systems Word Search: Controlling and securing access to data and Threats and software vulnerabilities (Modules 13–40) 20 words to find · Confidentiality, Integrity, Availability, Authentication vs authorisation and more

🔎

Years 9–10 Digital Systems Word Search: Threats and software vulnerabilities to Threat modelling and security responses (Modules 41–79) 20 words to find · SQL injection, Buffer overflow, Zero-day vulnerabilities, Insider threats and human error and more

✎

VCE Spreadsheets, SQL & Visualisation Crossword: Spreadsheet structure, formulas and functions and Descriptive statistics (Modules 4–20) 10 clues · Naming worksheets consistently, Header labels for rows and columns, Relative and absolute cell references, The COUNTIF function and more

🔎

VCE Spreadsheets, SQL & Visualisation Word Search: Spreadsheet structure, formulas and functions to Manipulating, validating and testing spreadsheet data (Modules 4–34) 20 words to find · Naming worksheets consistently, Header labels for rows and columns, Relative and absolute cell references, The COUNTIF function and more

✎

VCE Software Development U4O2 Crossword: Organisational goals and in-house vs external development to Vulnerabilities and risks in insecure development environments (Modules 1–22) 10 clues · Goals and objectives of medium and large organisations, Security as an organisational objective, Medium and large organisations compared, In-house development: advantages and more

✎

VCE Software Development U4O2 Crossword: Vulnerabilities and risks in insecure development environments and Third-party software, code review and combined environments (Modules 23–47) 10 clues · What makes a development environment insecure, What an API is, Risks of using APIs, Hard-coded API keys and secrets and more

✎

VCE Software Development U4O2 Crossword: Security controls for development practices and stored data and Threat modelling and evaluating security practices (Modules 49–72) 10 clues · Code repositories, Securing a code repository, Encrypting data at rest and in transit, Peer code review process and more

🔎

VCE Software Development U4O2 Word Search: Organisational goals and in-house vs external development to Third-party software, code review and combined environments (Modules 1–47) 20 words to find · Goals and objectives of medium and large organisations, Security as an organisational objective, Medium and large organisations compared, In-house development: advantages and more

🔎

VCE Software Development U4O2 Word Search: Security controls for development practices and stored data to Mitigation and improving secure development practices (Modules 49–130) 20 words to find · Code repositories, Securing a code repository, Encrypting data at rest and in transit, Peer code review process and more

✎

VCE Data Analytics U4O2 Crossword: Why data security matters and types of threats and Data integrity and its consequences (Modules 1–25) 10 clues · Goals and objectives of medium and large organisations, Safeguarding business operations, Mitigating financial loss and reputational damage, Accidental threats to data and more

✎

VCE Data Analytics U4O2 Crossword: Evaluating security with CIA and security controls to Disaster recovery plans (Modules 44–79) 10 clues · Adaptive (risk-based) authentication, Physical security controls, Data loss prevention controls, Protecting data at rest and more

✎

VCE Data Analytics U4O2 Crossword: Victorian privacy and health records legislation to Emerging trends in cyber security (Modules 115–134) 10 clues · Comparing the three privacy laws, Privacy Amendment (Notifiable Data Breaches) Act 2017, Eligible data breach and serious harm (ss 26WE, 26WF), Assessing a suspected breach (s 26WH) and more

✎

VCE Data Analytics U4O2 Crossword: Emerging trends in cyber security and Ethical issues and case-study analysis (Modules 135–150) 10 clues · User behaviour analytics: detecting anomalies, Privacy and accuracy limits of behaviour monitoring, Attackers using AI, Ethical issue: data collection and use and more

🔎

VCE Data Analytics U4O2 Word Search: Why data security matters and types of threats to Evaluating security with CIA and security controls (Modules 1–43) 22 words to find · Goals and objectives of medium and large organisations, Safeguarding business operations, Mitigating financial loss and reputational damage, Accidental threats to data and more

🔎

VCE Data Analytics U4O2 Word Search: Evaluating security with CIA and security controls to Victorian privacy and health records legislation (Modules 44–113) 21 words to find · Adaptive (risk-based) authentication, Physical security controls, Data loss prevention controls, Protecting data at rest and more

🔎

VCE Data Analytics U4O2 Word Search: Victorian privacy and health records legislation to Ethical issues and case-study analysis (Modules 115–150) 21 words to find · Comparing the three privacy laws, Privacy Amendment (Notifiable Data Breaches) Act 2017, Eligible data breach and serious harm (ss 26WE, 26WF), Assessing a suspected breach (s 26WH) and more

✎

IGCSE Computer Science Paper 1 Crossword: 2.2 Methods of Error Detection and 2.3 Encryption (Modules 189–203) 10 clues · Choosing an error detection method for a scenario, Interception of data on a network, Plaintext, Ciphertext and more

✎

IGCSE Computer Science Paper 1 Crossword: 2.3 Encryption and 3.1 Computer Architecture (Modules 204–217) 10 clues · Private key, Encrypting with the recipient's public key, Decrypting with the private key, Sending a secure message with asymmetric encryption and more

✎

IGCSE Computer Science Paper 1 Crossword: 5.2 Digital Currency and 5.3 Cyber Security (Modules 520–546) 10 clues · Working out ownership from the blockchain, Stopping the same digital currency being spent twice, Writing exam answers about digital currency and blockchain, Trojan horse and more

✎

IGCSE Computer Science Paper 1 Crossword: 5.3 Cyber Security and 6.1 Automated Systems (Modules 553–577) 10 clues · Access levels, Anti-spyware software, What a proxy server is, How a proxy server keeps data safe and more

🔎

IGCSE Computer Science Paper 1 Word Search: 2.2 Methods of Error Detection to 3.1 Computer Architecture (Modules 189–217) 20 words to find · Choosing an error detection method for a scenario, Interception of data on a network, Plaintext, Ciphertext and more

🔎

IGCSE Computer Science Paper 1 Word Search: 5.2 Digital Currency and 5.3 Cyber Security (Modules 510–546) 21 words to find · Digital ledger, What a ledger record contains, Time-stamp, A record that cannot be altered and more

🔎

IGCSE Computer Science Paper 1 Word Search: 5.3 Cyber Security and 6.1 Automated Systems (Modules 553–607) 21 words to find · Access levels, Anti-spyware software, What a proxy server is, How a proxy server keeps data safe and more

✎

ACARA Digital Technologies Years 5–6 Crossword: Staying Safe Online (Modules 137–153) 10 clues · What can happen if someone gets into your account, Longer means harder to guess, Building a passphrase from random words, Passphrases to avoid and more

🔎

ACARA Digital Technologies Years 5–6 Word Search: Staying Safe Online and Digital Footprints (Modules 137–225) 21 words to find · What can happen if someone gets into your account, Longer means harder to guess, Building a passphrase from random words, Passphrases to avoid and more

✎

ACARA Digital Technologies Years 7–8 Crossword: Programming with Control Structures and Functions (JavaScript) and Networks and Cyber Threats (Modules 635–666) 10 clues · Random whole numbers with Math.random() and Math.floor(), Combining sequence, selection and iteration in one program, Writing a program that uses functions and control structures, Higher or lower number guessing game and more

✎

ACARA Digital Technologies Years 7–8 Crossword: Networks and Cyber Threats (Modules 674–695) 10 clues · Checking whether an account appears in a data breach, Setting up MFA with an authenticator app, Backup codes and account recovery, Why data is encrypted and more

✎

ACARA Digital Technologies Years 7–8 Crossword: Networks and Cyber Threats and Digital Footprints and Data Minimisation (Modules 696–726) 10 clues · Substitution cipher, Transposition cipher, Keeping an encryption key secret, Why a Caesar cipher is weak compared with modern encryption and more

🔎

ACARA Digital Technologies Years 7–8 Word Search: Programming with Control Structures and Functions (JavaScript) and Networks and Cyber Threats (Modules 635–695) 21 words to find · Random whole numbers with Math.random() and Math.floor(), Combining sequence, selection and iteration in one program, Writing a program that uses functions and control structures, Higher or lower number guessing game and more

🔎

ACARA Digital Technologies Years 7–8 Word Search: Networks and Cyber Threats and Digital Footprints and Data Minimisation (Modules 696–770) 22 words to find · Substitution cipher, Transposition cipher, Keeping an encryption key secret, Why a Caesar cipher is weak compared with modern encryption and more

✎

Crossword: Modular and Object-Oriented Programming (JavaScript) and Cyber Security Threats and Vulnerabilities (Modules 743–781) 10 clues · One class, many objects, Storing objects in an array, Methods calling other methods, Choosing properties and methods for a class from a scenario and more

✎

Crossword: Cyber Security Threats and Vulnerabilities (Modules 782–809) 10 clues · Physical social engineering: tailgating and baiting, Data flow diagram of a system, Mapping STRIDE threats to confidentiality, integrity and availability, Writing a threat statement and more

✎

Crossword: Cyber Security Threats and Vulnerabilities (Modules 810–827) 10 clues · Zero-day vulnerabilities, Outdated versions of software, Default credentials and insecure settings, Improper credential management and more

✎

Crossword: Cyber Security Threats and Vulnerabilities (Modules 828–859) 10 clues · Analysing a real supply chain attack, Code signing and trusted sources, Software bill of materials (SBOM), Reducing supply chain risk and more

✎

Crossword: Cyber Security Threats and Vulnerabilities (Modules 860–875) 10 clues · Frequency analysis, Transposition cipher: rail fence, CODE and CHAR functions in a spreadsheet, The MOD function in a spreadsheet and more

✎

Crossword: Cyber Security Threats and Vulnerabilities and Privacy Principles and Digital Footprints (Modules 876–944) 10 clues · Brute-forcing a Caesar cipher in Python, Vigenere cipher in Python, The XOR cipher, Base64 is encoding, not encryption and more

🔎

Word Search: Modular and Object-Oriented Programming (JavaScript) and Cyber Security Threats and Vulnerabilities (Modules 743–809) 21 words to find · One class, many objects, Storing objects in an array, Methods calling other methods, Choosing properties and methods for a class from a scenario and more

🔎

Word Search: Cyber Security Threats and Vulnerabilities (Modules 810–859) 21 words to find · Zero-day vulnerabilities, Outdated versions of software, Default credentials and insecure settings, Improper credential management and more

🔎

Word Search: Cyber Security Threats and Vulnerabilities and Privacy Principles and Digital Footprints (Modules 860–944) 20 words to find · Frequency analysis, Transposition cipher: rail fence, CODE and CHAR functions in a spreadsheet, The MOD function in a spreadsheet and more