Unit 1, Day 3: Passwords, Passkeys and Multifactor

Lesson 3 of 6 in Unit 1, Spot It, Lock It, Recover

School-year day

Day 3 of 180

Time

20-minute core + 30-minute extension (50 minutes in all)

Teacher Talk with MystrS. Checked October 27, 2026 (Pacific time). Tags: Cyber.

Existing lessons: /cyber/data-breach-what-to-do/, /teach-it-this-week/data-breach-what-to-do/, /cyber/scam-text-signs/, /cyber/public-wifi-risks/

Goal: Students will be able to:

• Explain the difference between a password, a passkey and multifactor authentication.
• Choose a stronger lock option for a made-up account.
• State why they will never type a real password as class work.

Materials:

• Projector
• Password strength sorting cards (made-up passwords only)
• Lock choices handout (password only / password + app prompt / passkey)
• Exit tickets

Core (20 min)

1. Warm-up. Teacher: "Today we lock accounts. We will never type a real password in class." Students answer on paper: why is reusing the same password on school email and a game a problem? (3 min)
2. Teach plain definitions. Password: a secret string you type; longer and unique is better. Multifactor authentication (MFA): something you know plus something you have or are (phone prompt, authenticator app, hardware key, or biometric on a device you control). House style: write "multifactor" as one word. Passkey: a modern sign-in that uses a key on your device instead of typing a password; harder for a scammer to steal by tricking you into typing it. CISA guidance (paraphrase): turn on MFA for important accounts; prefer app-based or hardware options over SMS when you can. Optional teacher-account demo only if the district allows. (7 min)
3. Activity, Lock the account. Made-up profile Jordan reuses an 8-character password on email, shopping and a game; phone can run an authenticator app. Pairs complete: what to change first; password only vs password + MFA vs passkey; what never to do if a text asks for a login code. Share two tables. (7 min)
4. Exit ticket. Define MFA in one sentence. Name one account type that should get MFA first, and why. (3 min)

Extension (up to 30 min)

• Password manager talk at awareness level (stores unique passwords; unlock with one strong master method). Note district blocks. No product endorsement. (10 min)
• Skim /teach-it-this-week/data-breach-what-to-do/. List first two steps after a made-up shopping-site password leak. (10 min)
• Groups design a one-page Lock It classroom poster: unique passwords, MFA, never share codes. No scare images. (10 min)

Check for understanding: Student defines MFA as more than one factor, and chooses password + MFA or passkey over password-only for Jordan's email.

Differentiation and EL / IEP supports:

• EL: icons for password / phone prompt / passkey; sentence frame "MFA means ___ plus ___."
• IEP / 504: prefilled table with two options to circle; oral exit ticket OK.
• Advanced: compare SMS codes vs authenticator app at awareness level (SIM risk preview for Day 4) without inventing percentages.
• No student logins: entire day uses made-up Jordan.

Standards (from our standards map):

• CSTA 2026: HS-SYS-SE-32 (and related authentication practices as mapped)
• CSTA 2017: 2-NI-05; 3A-NI-08 where locally adopted
• NICE: PD-WRL-006 (credential risk awareness)
• NSPFE: Managing Risk

Certification alignment (ISC2 CC): Domain 1.1 Authentication, Authorization, Accounting; Domain 3 Identity and Access Management (logical access, awareness); Domain 2.3 password protection. Outline: English, Revised 01-2026, effective September 1, 2026. https://www.isc2.org/certifications/cc/cc-certification-exam-outline

Sources

1. CISA: Multifactor Authentication, checked October 27, 2026.
2. CISA: More than a Password, checked October 27, 2026.
3. NIST Digital Identity guidelines overview (SP 800-63), teacher background only, checked October 27, 2026.
4. ISC2 CC Exam Outline, Revised 01-2026, checked October 27, 2026.