Daily Learning Contract
- Topic: Phishing and Integrity
- Objective: Students will define integrity and identify how it appears in cybersecurity work by analyzing message evidence and choosing a safe professional response.
- TEKS: d(4)(F)
- Demonstration of Learning: Students classify seven messages, explain the hardest decision with visible evidence, state the safe response, and name one integrity behavior a cybersecurity worker demonstrates.
Lesson Overview
| Time | 50 minutes |
| District HQIM | FYF pp. 24-25, Safe or Spoofed? |
| Locked visual source | Climber Notes slides 2-8, embedded individually in Canvas |
| Materials | Seven email images, Phishing Red-Flag Checklist, workbook or Canvas guide |
Before Students Arrive
- Open all seven locked email images in Canvas and confirm they are readable from the back of the room.
- Post or print the Phishing Red-Flag Checklist.
- Keep the answer guidance on the unpublished teacher page. The Climber Notes deck has no speaker-note key.
- Post the response sequence: Pause. Verify independently. Report. Delete.
Bellringer — Evidence Before a Decision (5 min)
Project Email 1 without asking students to click anything.
Prompt: Name one thing you can see that should slow you down. Do not decide yet.
Take two observations, then separate observation from decision: “The sender is freerewards@prize-center123.net” is visible evidence. “It is spoofed” is the decision supported by that evidence.
Activity 1 — Five Red Flags (10 min)
Use FYF p. 24 and teach one clue at a time:
- strange sender address;
- urgent or emotionally loaded language;
- request for private information;
- suspicious link or attachment; and
- spelling or grammar problems.
Two boundaries matter:
- one typo does not automatically make a message fake; and
- a polished message with no obvious flags is not automatically safe.
Hovering may preview a link on a desktop, but it does not verify the sender. On touch devices, students use the visible domain and verify through a trusted route.
Activity 2 — Seven-Email Investigation (23 min)
Open one email at a time. Students first mark visible clues, then choose Safe-looking or Spoofed. Use Safe-looking, not “proven safe,” for Emails 3 and 7.
After Email 4, pause for a Think-Pair-Share:
“The strongest clue is ___ because . The safe next action is .”
Both partners record their own evidence. Students do not need to circle directly on a projected image; the checklist supplies accessible labeled fields.
Activity 3 — Safe Practice Draft (7 min)
Preserve the FYF practice extension with firm boundaries. Students draft on paper or in the assigned private document only. They use a fictional organization, fictional person, and an example.com address. They may include two written red flags, but they may not include a working link, QR code, attachment, password request, real credential, real person's name, or Irving ISD impersonation. The message is never sent or posted.
If time is tight, the draft becomes a two-line subject/sender/message sketch instead of a full email.
Exit — Professional Response and Integrity (5 min)
Students finish three lines:
- The hardest email was ___ because ___.
- Instead of clicking or replying, I would ___.
- A cybersecurity worker shows integrity by ___ because ___.
Teacher Key
| Decision | Visible evidence and safe response | |
|---|---|---|
| 1 | Spoofed | Prize pressure, odd sender, unrelated claim link. Report and delete. |
| 2 | Spoofed | amaz0n uses a zero; order-check domain is not the official company site. Verify through the official order history. |
| 3 | Safe-looking | Company HR sender, ordinary reminder, no link or private-information request. If uncertain, verify through the known HR contact or official portal. |
| 4 | Spoofed | .co sender, TODAY pressure, unrelated update domain. Use the official benefits portal instead. |
| 5 | Spoofed | Account-suspension pressure, one-hour deadline, unrelated fix domain. Contact known IT support. |
| 6 | Spoofed | .co sender and portal-login link. Open the known portal independently. |
| 7 | Safe-looking | Ordinary manager note, no link, attachment, or private-information request. Verify through the known manager/channel if anything feels unusual. |
Supports
- Read sender and domain strings aloud and enlarge the image when needed.
- Use the frame: “I marked ___ because I can see ___.”
- Let pairs discuss before each individual decision.
- Provide a text description of visible evidence for low-vision access without announcing the answer.
- Score evidence and revision, not whether the student's first call matched the key.
If a Student Is Absent or a Device Is Unavailable
The seven locked images and checklist are the complete independent route. No live email account, link, or partner is required.