Day 1 mission · 45 to 60 minutes · no cyber knowledge needed
Incident Zero
INCIDENT REPORT · 08:05
It is 8:05 a.m. at Northstar Academy. The school's online portal was taken offline after unusual activity was detected overnight. No one yet knows exactly what happened.
Your team must review five pieces of evidence before the system can be restored. Each one is a different layer of cybersecurity. Everything you need is in the evidence. Identify the problem, justify it with evidence, and unlock the recovery word.
Playing in a team? Pick roles
- Evidence Lead: reads the evidence aloud and keeps the team on the documents.
- Analyst: proposes the answer and explains the reasoning.
- Skeptic: checks whether the evidence really supports the answer.
- Recorder: writes the final answer and justification. In a team of three, combine Analyst and Recorder.
Challenge 1 · Introduction to Security · Analyze risk
Which risk matters most?
Risk register · For this activity: Risk score = Likelihood × Impact (1 low to 3 high)
| Asset or situation | Likelihood | Impact | Score |
|---|---|---|---|
| Public event calendar temporarily unavailable | 3 | 1 | ? |
| Staff administrator account compromised | 2 | 3 | ? |
| Cafeteria menu edited | 2 | 1 | ? |
| Public club page unavailable | 1 | 2 | ? |
Hint
Use the formula provided. Which score is largest?
Show answer
Answer: B. Unlock letter: L. Risk score = likelihood × impact. The staff administrator account scores 2 × 3 = 6, the highest.
Challenge 2 · Securing Spaces · Analyze and mitigate risk
Who should not have been there?
Physical security policy
- The server room requires an authorized staff badge.
- Visitors must remain with their staff host while inside restricted areas.
- Visitor badges cannot independently open the server room.
Visitor register: V17 = delivery contractor. Host = not recorded.
| Time | Badge | Location |
|---|---|---|
| 07:52 | Staff 118 | Main Entrance |
| 08:01 | Staff 204 | Server Room |
| 08:04 | Visitor V17 | Main Entrance |
| 08:11 | Visitor V17 | Server Room |
Hint
Compare the access record with every sentence in the policy.
Show answer
Answer: D. Unlock letter: A. Visitor V17 appears in the server room access record even though visitor badges cannot independently open the server room (rule 3). No host was recorded, so the escort rule (rule 2) may also be broken.
Challenge 3 · Securing Networks · Mitigate risk
Which connection should never be allowed?
Network policy
- Guest Wi-Fi may access the internet.
- Guest Wi-Fi must not access internal administrative systems.
- The Student Records Server is an internal administrative system.
| Source | Destination | Result |
|---|---|---|
| Guest Wi-Fi | Internet | ALLOW |
| Staff Network | Student Records Server | ALLOW |
| Guest Wi-Fi | Student Records Server | ALLOW |
| Student Network | Internet | ALLOW |
Hint
Which destination should guests never reach?
Show answer
Answer: C. Unlock letter: Y. Guest Wi-Fi may reach the internet but must not reach internal administrative systems, and the Student Records Server is one. Change that rule to DENY.
Challenge 4 · Securing Devices · Analyze and mitigate risk
Which device would you secure first?
Device management dashboard
| Device | Updates | MFA | Screen lock | Account |
|---|---|---|---|---|
| A | Current | On | 2 min | Standard |
| B | Current | On | 5 min | Standard |
| C | 92 days overdue | Off | Never | Administrator |
| D | Current | On | 2 min | Standard |
MFA is multifactor authentication: extra proof of identity on top of a password.
Hint
Look for several weaknesses on the same device.
Show answer
Answer: C. Unlock letter: E. Device C stacks four weaknesses: updates 92 days overdue, multifactor authentication off, no screen lock, and an administrator account.
Challenge 5 · Securing Applications and Data · Mitigate risk
Who can see the data?
School data policy
Sensitive student information may only be accessed by authorized staff.
Hint
Which file contains information that should not be public?
Show answer
Answer: D. Unlock letter: R. Medical accommodations are sensitive student information, which only authorized staff may access. "Anyone with the link" lets anyone who gets the link open it. A better setting: restricted to the authorized staff who need it.
Final unlock
Combine your five letters in order to get the recovery word.
Debrief: why LAYER?
Strong cybersecurity is built in layers of protection across spaces, networks, devices, applications and data. One weakness rarely explains everything: today you found one in every layer. Security professionals call this defense in depth.
- Did one weakness create all the risk, or did several matter?
- Which layer surprised you most: spaces, networks, devices, applications or data?
- What did your team do today that felt like cybersecurity? (Hint: you analyzed risk, chose mitigations, spotted evidence of an attack and collaborated: the four AP® Cybersecurity skills.)
Exit ticket: Before today, what did you think cybersecurity was? What is one thing you now realize it includes?
You were not expected to know cybersecurity today. The course teaches you to reason with harder evidence and real tools. Start Unit 1 →
For teachers: run it in class
Day 1 or 2 · 45 to 60 minutes · teams of 3 or 4 · no prior knowledge · works projected, on student devices, or printed (use your browser's Print).
| 45-minute version | 60-minute version |
|---|---|
| 0 to 4: mission briefing | 0 to 5: mission briefing |
| 4 to 7: team roles | 5 to 10: roles and model thinking |
| 7 to 32: five challenges | 10 to 42: five challenges |
| 32 to 35: final unlock | 42 to 47: final unlock |
| 35 to 44: debrief | 47 to 58: debrief |
| 44 to 45: exit ticket | 58 to 60: exit ticket |
Facilitation moves. When teams ask for the answer, ask "What evidence points to that conclusion?" Give a hint rather than the whole answer. Push students to separate risk, evidence and mitigation. Save vocabulary for the debrief, and celebrate careful reasoning, not just speed.
Unit links. Challenge 1: Unit 1, analyze risk. Challenge 2: Unit 2, analyze and mitigate risk. Challenge 3: Unit 3, mitigate risk. Challenge 4: Unit 4, analyze and mitigate risk. Challenge 5: Unit 5, mitigate risk.
Accessibility. Read the brief aloud and keep instructions visible. Let teams annotate or use a shared document. Give hints freely on Day 1. For English language learners, preview: risk, evidence, policy, access, permission.
Answer key. 1 B (L) · 2 D (A) · 3 C (Y) · 4 C (E) · 5 D (R) · LAYER.