How to Teach Networking and Cybersecurity With Paper Labs in High School

Short answer: You can teach networking and cybersecurity without software if the labs run on paper with synthetic data. Move from layer models to IPv4 addresses, subnets, ports, DNS and TLS, then to threats and incident response. Students should leave with twelve completed lab logs and a project that shows their reasoning.

Why paper works for a first course

Many schools cannot install network tools, and many teachers would rather not have students run attacks on a school network. Paper labs avoid both problems. Students read addresses, logs and records and explain what they see.

The Cybersecurity Foundations: Networking unit works this way. All work is on paper with synthetic data. No attacks are carried out and no tools are installed. It has 57 classroom pages and a 25-page teacher guide with answers and a key for each lab. It is an independent starter unit, not affiliated with or endorsed by College Board.

Be open with students about the limits. A paper lab teaches how to read and reason about network data. It does not teach tool use. Say so, and say that tool-based work can come later in a course that has the equipment and a lab policy.

The eight lessons in order

The lessons build from structure to defense:

• Lesson 1: Layer models. Matching functions to the layers of a network model.
• Lesson 2: IPv4 addresses. Structure and classification.
• Lesson 3: Subnets and routing. Subnets and route selection on paper models.
• Lesson 4: Ports and transport. Reading ports and transport connections.
• Lesson 5: DNS and services. How names are resolved and how common services work.
• Lesson 6: TLS and metadata. What encryption protects and what stays visible.
• Lesson 7: Threats and defense. Typical threats set against protective measures.
• Lesson 8: Detection and response. Spotting incidents in logs and planning the response.

Do not skip Lesson 2. Subnets, routing and ports all depend on students being comfortable with how an address is built.

Timing a lesson block

Each lesson has an introduction page, a practice and explanation page and a case card. For a 50-minute period, one split is:

• 10 minutes: Introduction page. Work one example on the board.
• 20 minutes: Practice page, individually or in pairs.
• 15 minutes: Case card, where students solve a task and justify their approach.
• 5 minutes: Check one answer against the key.

Lessons 2 and 3 usually need two periods, because binary and prefix work is slow for beginners. Lesson 6 can be quicker if students already know what a certificate is.

Running the twelve paper labs

The twelve labs are the core of the unit. They include address classification, prefix comparison, a routing paper model, synthetic DNS and TCP records, a failed login log, an access matrix, a phishing report and incident communication.

Each lab has its own reasoning log page. Ask students to write what they see, what they conclude and what else they would need to know. The third question matters. Real analysts rarely have enough information, and students should get used to saying so.

Spread the labs through the lessons, not at the end. A lab on prefix comparison fits right after Lesson 3, and the failed login log fits near Lesson 8. Each lab has a key in the teacher guide.

Ask students to swap logs with a partner and mark each other's third question, the one about what else they would need to know. The networking and security unit has a key for every lab, so you can check a sample of the pairs afterwards.

What students produce

By the end, each student should have a set of lab logs, case card answers and a project. The unit also has a precise models and interpretation page, two vocabulary pages and a learning check. A project brief, project record and reflection page finish it.

When you grade the logs, look at the reasoning first. A student who classifies an address wrongly but explains the steps has made a fixable error. A student with the right answer and no reasoning has not shown you much.

Because the data is synthetic, you can share the logs with a whole class without worrying about real names or systems.

The phishing report and incident communication labs are a good place to practice clear writing. Ask for a message a non-technical manager could follow in a minute.

Pairing with other units

For a second unit for older students, Business and Personal Finance Starter Units gives a different kind of calculation and reasoning.

Younger students who need a media literacy base before this may start with Spotting Misinformation and Deepfakes, which is written for grades 6–8.

For more options in this area, see cybersecurity and networking units for high school.

Every resource is built around the curriculum you teach – and if something doesn't fit your standards, the TeachLessons Guarantee applies: we adapt it for you.