Māori

In collaboration with:

Supported by:

Tēnā koutou katoa. Cyber Skills Aotearoa consists of unplugged and online resources that provide teachers and students with classroom-ready activities and challenges to develop students’ cyber security skills and dispositions.

Activities and challenges are aligned with Hangarau wāhanga ako | Technology learning areas and are free for Aotearoa New Zealand students in years 6-13. All learning resources are available in English and te reo Māori.

The activities and challenges are developed by Grok Academy, in partnership with Tātai Aho Rau CORE Education, the New Zealand Government, and industry.

< back to top

Cyber Skills Aotearoa Programme

Activities and challenges are aligned with Hangarau wāhanga ako | Technology learning areas, and raise awareness of cyber security careers.

The first course of the Cyber Skills Aotearoa programme focuses on topics related to information security:

Sharing information via social media (Years 6-13)
Passwords (Years 6-13)
Phishing and scams (Years 9-13)
Multi-factor authentication (Year 9-13)

The full Cyber Skills Aotearoa programme consists of the following courses:

Information privacy and security course (available now)
Web Application Security (available Term 3, 2023)
Cryptography (available Term 1, 2024)

And competitons:

Cyber Comp (Term 1 and Term 4 2023)

If you are new to Grok, welcome! If you're looking for help on how to get your students started on these activities, here are a couple of articles explaining how to register students and how to assign a course to your students.

< back to top

Webinars

Security at Amazon Web Services

Join Grok's Julie McMahon as we discuss what is AWS, their aproach to security, security principles and the shared responsibiltiy model.

We would like to thank Cameron Tod from AWS and Grok Learning for providing some excellent, comprehensive and interesting material that will be of use to you in your classroom to support students with the L2 DCAT.

Courses

Information Privacy and Security (9-13)

This course is for ākonga in years 9-13 and covers purposeful sharing, password security, password reuse and multi-factor authentication (MFA) and phishing and scams.

Tātai Aho Rau Core Education collaborated with us on localising the content to be authentically relevant for Aotearoa New Zealand ākonga, which has been endorsed by the Ministry of Education Te Tāhuhu o te Mātauranga.

To find out more about the learning programme, curriculum coverage, classroom activities, check out our Kaiako Guide

Kaiako Guide

Courses:

English Te reo Māori

This online content of the course is expected to take approximately 4-6 hours for years 9-13 ākonga. However, it may take longer to complete the modules depending on how many of the suggested activities in the kaiako guide are integrated into your learning programme.

NEW! Information Privacy and Security (6-8)

This course is for ākonga in years 6-8 and covers sharing responsibly and password security.

To find out more about the learning programme, curriculum coverage, classroom activities, check out our Kaiako Guide

Kaiako Guide

Courses:

English Te reo Māori

This online content of the course is expected to take approximately 2-3 hours for years 6-8 ākonga. However, it may take longer to complete the modules depending on how many of the suggested activities in the kaiako guide are integrated into your learning programme.

NEW! Web Application Security

With web apps all around us, this course allows ākonga to explore the features of web apps and how data may be either exposed, changed, or corrupted by hackers.

The course contains four websites that ākonga will explore to have a real life experience of exploring vulnerabilities in web apps.

To find out more about the learning programme, curriculum coverage, classroom activities, check out our Kaiako Guide

Kaiako Guide

Courses:

English Te reo Māori

< back to top

Cyber Comp

Cyber Comp is free for Aotearoa New Zealand students in years 6-13. The next competition will be held in Term 4, 2023 and will run for four weeks. Cyber Comp introduces students to problems that require the application of cyber security knowledge and skills.

After taking part in Cyber Comp students will:

Have a greater understanding of the importance of protecting their personal information.
Know how to create stronger passwords.
Be able to evaluate emails and text messages to reduce the risk of falling victim to scams.
Understand what to do if they receive a scam email or message.

< back to top

Cyber classroom resources

Poster - How good are your passwords? Download this poster to teach your students how to create good passwords.

English Māori

Poster - Too good to be true? Download this poster to help your students identify a scam online.

English Māori

Card deck - Cyber card game - download your free classroom set of these cyber cards to promote discussion on cyber security practice in your classroom.

Note: print out the cards double-sided

English Māori

Information Flyer Download and share this flyer to spread the word about the Cyber Skills Aotearoa program.

Māori/English

< back to top

Video resources

Information Privacy and Security Content

Click here for a video transcript

When we go online, we interact with many people and many systems.

We willingly post information about ourselves, what we're doing, where we're going, and even what we're thinking.

We click on links all the time, and all of this creates very valuable data about you.

This data is sent to computers and it’s stored and then it's analysed by other computer programs. You've heard of the term cyber safety.

Now we're going to be chatting cyber security.

It requires us to protect our data in the same way that we protect our money. In this challenge, we'll explore the online habits and practices that put us and our data at risk.

We want to share our expertise to show you how you can best protect yourself online.

Chris Hislop, Product Owner Identity and Access Management, BNZ discusses why keeping your data secure matters in protecting your identity.

Click here for a video transcript

Your online accounts are often secured with passwords.

A password is an example of authentication.

You use your password to control access to online data.

A good password needs to be easy enough for you to remember, but difficult for another person to guess.

If your password is easy to guess, it's not safe.

Pet names, popular words and memes are not good passwords.

Too many people may know this information.

Let's talk about PINs.

There are 10,000 possible four digit PINs.

That may sound like a lot to a human, but not for a computer.

A computer program can try out millions of combinations of short and simple passwords in just a few seconds.

The longer the password, the more time it takes for a computer to run through every possible combination of letters, numbers and symbols.

So what makes a good password?

It should be something only you know, that isn't a common word, and is long enough so that algorithms can't crack it easily.

Taylor Whiteman, Security Analyst, Identity and Access Management BNZ, explains the features of a good password.

Click here for a video transcript

People often reuse their passphrases on many accounts.

But this is a very risky thing to do.

Data breaches - that is, when data get stolen from a company - are all too common.

The stolen data often includes login information and passphrases.

It is easy for a hacker to write a simple computer program to try the stolen email and passphrase combinations on lots of other services online. And it's just a matter of time before they get lucky.

So what does this mean for you?

If you're reusing your passphrase anywhere, then those accounts are not secure. This is especially important for websites that contain your personal or financial information.

Make sure that these sites use passphrases that are different to each other. And if you're unlucky enough to get caught up in a data breach, go to that account and change your passphrase as soon as possible.

A simple way to remember multiple passphrases is to use a password manager.

These are programs that can store all your passphrases with one master passphrase.

This means that you only need to remember one very strong passphrase.

Captain Jessie Keivom-Lockhart, Cyber Specialist (Land), Capability Branch NZ Defence, explains why we should not reuse passwords.

Click here for a video transcript

The most common type of scam is phishing. It's where scammers use your personal data to steal from you.

Scammers can access your most common accounts like banking, email, and social media.

They can open bank accounts, take over your sim card, purchase expensive things, or even steal your money.

Scammers can impersonate you to then easily scam your friends.

Your identity matters.

Luckily, the things to watch out for in phishing are very similar to scams in general.

We'll look out for the red flags but we're also watching out for untrusted sources and dodgy designs.

Phishing scams are unfortunately very common and cause a lot of damage.

So it's really important to know how to spot and avoid these scams.

Shaz Hussain, Fraud Detection Specialist ASB, discusses how scammers can use your identity details and what we can do to avoid this happening.

Click here for a video transcript

Scammers can hack the accounts of your friends and family to take advantage of your trust.

Once a friend of yours has been phished, they might send you some weird stuff, which could then put you at risk.

They can also pretend to be known companies that you wouldn't normally be suspicious of like NZ Post – but these companies will never ask you to give up your personal information in messages, emails, and random websites.

This means that sometimes messages that appear to come from trusted sources can be scams.

If a friend makes an unusual request for a lot of money, your log in details, or other private information with some urgency, it could be a scam.

So chat to them in person, or at least using a different app to make sure it really was them that sent the request.

If it doesn't feel right, think before you act.

Sam Leggett, Senior Analyst, Threat and Incident Response CERT NZ, talks about what we can do to avoid being scammed.

Web Application Security Content

Click here for a video transcript

We use web apps every day for keeping up with our friends, shopping, and catching up on the latest news. In fact, you are using one right now! But what are web apps?

In the past, web servers usually just delivered information to your device. Over time web apps have become more interactive and focused on you, the user.

This means that our devices need to exchange information with the web apps we use, like:

Where we are

Who we are

What we want

What we like

What we do and

When things happen

This allows web apps to look and behave differently for different people. It also means that bugs or poor design can leave your information open to hackers.

In this Challenge, you will learn how web apps remember information about what we do such as:

filling a cart when shopping

booking tickets or

working and studying online

You will also learn about the consequences of a hack for you, other users, and for the owners of the businesses behind these web apps.

Graeme McLellan, Digital Security including Cyber Awareness, BNZ explains what a web application actually is.

Click here for a video transcript

Hey, do you realise what you just did?

In the last problem, you accessed a page in a web app that wasn't meant for you. We asked you to do it, but did you think about whether it was a good idea or not?

Web app security isn't just about understanding how URLs work or how web apps may expose information that they shouldn't. A huge part of web app security is the ethics involved.

Security teams work around the clock to make sure information is kept secure and away from prying eyes. They're keeping the hackers at bay. But what motivates the hackers?

You probably think of hackers as having malicious intentions, and that is often the case. But there are other types of hackers out there too.

Ethical hacking is a term used for hackers who have a good motivation, say, improving a website's security by testing it, and having the permission of the owner of the website to hack and snoop. Another term you'll hear to describe this is a white hat hacker.

Compare this to a black hat hacker, who generally has bad intentions and no permission. And somewhere in the middle, you might hear about a grey hat hacker, someone with good intentions but no permission.

So think back.

In the last problem, would you have accessed the page if you knew it would show you someone else's medical history? Or given you early access to the tickets to your favourite band?

Cyber security raises question after question about what's right, what's wrong, and everything in between. You'll come across scenarios where we ask you to not only think about the security problems, but to do so in an ethical manner.

We want more white hat hackers out there.

George Thirkettle, CXO - Customer Experience Officer, ASB discusses some of the ethical issues about hacking.

Click here for a video transcript

If you're curious about finding weaknesses in web apps, there's a job for you in cyber security.

When we test the security of our web apps, we need to be sure that we don't miss anything. A fresh point of view is a really good way to check that hackers can't gain access to our information or software.

One technique is to invite ethical hackers to try and expose any vulnerabilities. These hackers have our permission to try and get into our systems. They're called a red team. Red teams are hired by us to use all their hacking skills ethically to try and find weaknesses in our web apps. They'll combine all their knowledge in new and creative ways to find gaps and ways to infiltrate our systems and tell us what they've found. That's the red team.

On the other side –our defenders –is the blue team, so what do they do? We hire them to deploy and respond as if it was a real attack, to see how current tools can handle a potential cyber attack. The blue team fortifies the system to withstand anything that the red team can throw at us.

These threat simulations might only last a few days, but they help us understand how hackers think and what lengths they'll go to to breach our systems.

Stefan Mijic, Cyber Security Consultant, BNZ talks about the attack and defence aspects of cyber security teams.

Click here for a video transcript

Cyber security is a balancing exercise. If you think about it, the best way to keep information secure is by never sharing it online, or in real life, or in fact, to never create that information.

Your bank account can't be hacked if you've never created one!

If you don't sign up for an email account, there is no password to keep secret.

But we know that's not how the world works.

Take a moment to think about what your day would look like if you had no online presence. How do you communicate with your friends…? … Decide what to do at the movies or on the TV…? … Find out your favourite recipe…?

Organisations have to balance keeping information secure but also giving access to it when we need it. One way to think about it is something called the CIA triad and we're not talking about any secret agents here. CIA stands for confidentiality, integrity, and availability.

These three principles guide the cyber security experts in their day-to-day job.

How do you make sure things that are intended to stay secret, remain secret?

How do you make sure that the information sent from a server is the same that you see on your computer?

How do you make sure people can access the information like banking details or flight bookings when they need it?

The complicated task of balancing these three out, confidentiality, integrity, and availability, is really important.

It requires a mix of technical skills, creativity, critical thinking and problem-solving.

Larna Findlay, Community Relations Manager, Corporate Affairs, BNZ describes the CIA triad - how we make decisions about security.

Click here for a video transcript

Have you ever visited a website that uses cookies? You may have agreed to allow cookies in a pop-up window.

A cookie is the name given to a labelled piece of data that web apps use to store information about you in your web browser.This makes your experience using the web app smoother and easier.

When you visit that web app next time, it may remember certain information about you, such as:

what you are interested in or

which part of the world you are from.

If you use developer tools to investigate cookies on a page, you might discover something interesting; it's actually possible to edit cookies.

If you can edit a cookie, this means you may be able to send the server information it wasn't expecting or send it information that has been altered with in an unauthorised way.

This is another way that the creator of a web app may reveal information that they didn't mean to reveal or trust information that they shouldn't rely on.

It would be pretty crazy if a user could trick a website into thinking they were someone else, just by changing the information that'stored in a cookie.

Imagine accessing someone's shopping basket or personal profile information on a website just by making a small change on your computer.

It's really important to know that actions such as editing cookies can land you in hot water quickly.

Our teams work around the clock to detect malicious behaviour.

Don't experiment with cookies unless you've got the website owner's permission.

Chris Hislop, Product Owner Identity and Access Management, BNZ explains what a cookie is (and no, it isn't food).

Career

Click here for a video transcript

Kia ora. My name is Chris and I work as the product owner for identity access management in the cybersecurity services department at BNZ.

Identity access management or IAM is one of the fundamental functions of a strong cybersecurity team.

Some of the problems that an IAM team work on include, how do you ensure that the staff in your business have access to the right things to do their job, but at the same time, how do you ensure that they don't have access to things that they shouldn't have access to?

Our team is responsible for running a centralised governance tool, which manages the accounts that staff have in all sorts of various applications across the bank.

This includes creating new accounts for new employees, managing access requests, and deprovisioning or deleting accounts for employees that leave the bank.

Five years ago almost all of these tasks were done manually. Now over 90% of them are automated through this centralised tool.

I think that the biggest challenge with cybersecurity is balancing convenience against security requirements, and applying the right levels of scrutiny and controls in the right places, but also at the same time allowing the business to go out and just do their thing.

Chris Hislop, Product Owner for Identity and Access Management in the Cybersecurity Department at BNZ, discusses what his role involves and the challenge of finding the balance between convenience and security.

Click here for a video transcript

Hi, I'm Taylor Whiteman, and I'm a security analyst at BNZ.

I want to start by saying that I didn't always work in cybersecurity.

When I graduated from university in 2015, I still wasn't sure what I wanted to do for a career.

Fast forward a few years and I came across the role I am in now.

I love the fact that with my job, I am constantly learning and come across new challenges on a regular basis.

I work within the identity access management team, and we're responsible for managing staff access to a large number of applications across the bank.

We also have to make sure that staff only have the access that they need in order to reduce any potential risks of someone having access that they shouldn't have.

We are always looking for new ways to improve our current processes.

Because as you know, technology is always evolving, and we need to ensure we're keeping up with it.

The constant changes in the industry make for an interesting and exciting career.

Let's see if you're up for the challenge.

Taylor Whiteman shares what she enjoys about the work she does in her role as a Security Analyst at BNZ.

Click here for a video transcript

Hi, I'm Captain Jessie Keivom-Lockhart.

I'm an officer in the New Zealand Army who specialises in cyberspace operations.

As an officer I get to plan military activities and lead new and exciting capabilities.

My work in cyberspace operation allows me to apply military techniques and defend our technology from hackers and advanced threats.

These activities and others help to protect the New Zealand Defence Force at home and abroad.

If you are passionate about the technical, but also passionate about serving NZ, and at the same time, you are keen to travel around the world, want regular training opportunities to improve your technical skills as well as military skills, and want to be part of the family that is Te Ope Kātua o Aotearoa, then joining the NZ Defence Force as a cyber professional could be for you.

Captain Jessie Keivom-Lockhart talks about her role in cyberspace operations with the New Zealand Army.

Click here for a video transcript

Hi, I'm Shaz Hussain, and I'm a fraud detection specialist at ASB.

A fraud detection specialist monitors and detects fraudulent financial activity in bank accounts and transactions.

My job is to respond to fraud alerts. If an alert appears on a customer's account, we will call the account holder to verify the charges are correct.

If they were not made by the customer, we try to stop the transaction from completing if it is possible and not too late.

When customers tell us that there are fraudulent charges on their account, we take the same steps – first investigating and then reporting suspicious activity to proper authorities.

I enjoy the challenge that comes with this role, which is working in a fast-paced environment. The time I take to respond to an alert can make the difference to how much money a customer ends up losing.

Fraud detection is an exciting career path because I enjoy interacting with people, doing investigations, and seeking justice for others.

Shaz Hussain, shares the challenges and excitement that she gets from her role as a Fraud Detection Specialist at ASB.

Click here for a video transcript

Kia ora. I'm Sam Leggett, and I'm a senior analyst in the threat and incident response team at CERT NZ.

CERT NZ is the Computer Emergency Response Team for New Zealand and our goal is to improve the online security of all New Zealanders and help Kiwis avoid cyber incidents.

My role is to respond to reports of cyber incidents with trusted and actionable advice so victims can deal with the incident and prevent further incidents in the future.

I also coordinate with key stakeholders in a major incident and share knowledge on cybersecurity and best practices through collaborative work and presentations on Cert New Zealand activity.

Being able to help a wide range of Kiwis with an equally wide range of cyber incidents is just one of the reasons why I enjoy my role.

I also appreciate being a part of a worldwide network of national CERT teams that all contribute to the global cybersecurity effort.

The landscape of cybersecurity is ever changing and this ensures no two days are the same. There's always something new to learn in this exciting industry.

Sam Leggett, CERT NZ, discusses his role in responding to and preventing cybersecurity incidents.

Click here for a video transcript

Hi, I'm Natasha Pereira, and I'm a security specialist at ASB Bank.

A security specialist helps protect data, systems, and networks from unauthorised access.

Sophisticated cyber attacks can originate anywhere in the world. My job is to keep our systems and ultimately our customer data safe from these attacks.

I enjoy the ever-evolving nature of the field and the need to be constantly learning and researching to stay ahead of people who are trying to break through our defences.

For me, it is really satisfying when I know that someone with malicious intent has tried to access our systems and they failed because of something that I have put in place.

A career in cybersecurity is rewarding as you can make a direct, positive impact by improving the safety of systems and consequently protecting the users of those systems – our people and communities.

Natasha Pereira, shares what she finds rewarding in her role at ASB Bank.

< back to top

In collaboration with:

Supported by:

< back to top