Code of Behavior and CIA Evidence Lab

Cybersecurity classes have a strange problem.

The more students learn, the more important the classroom rules become.

A command that is harmless inside a teacher-provided virtual machine may be inappropriate on a school network. A password-strength exercise using fake sample passwords can be useful. Trying real student credentials is not. A phishing-analysis lesson can teach defensive judgment. Sending a fake phishing message to someone who never agreed to participate crosses the line.

That is why the Garden State Cyber curriculum starts with an ethics agreement and a class Code of Behavior.

The agreement is not paperwork around the course. It is part of the technical environment.

The district sign-off requirement

The GSC I curriculum requires the ethics agreement to be signed by the student and parent/guardian during the first two weeks of class. The Code of Behavior you build here is instructional work that prepares you to understand what you are signing.

Do not treat the signature as a substitute for understanding. Before the agreement is submitted, you should be able to explain the authorization, privacy, credential, evidence, and safe-lab boundaries in your own words.

A usable rule has to answer a real decision

Weak classroom rule:

Be ethical.

It sounds good, but it does not tell you what to do when you face an actual choice.

Better rule:

Use only teacher-approved accounts, files, networks, and lab targets. If the target or action is not clearly authorized, stop and ask before continuing.

That rule is observable. A student can use it to decide whether an action is allowed.

A strong security Code of Behavior should cover at least these categories:

• authorization and scope
• privacy and personal information
• credentials and account access
• safe handling of suspicious files and links
• use of school networks and devices
• evidence collection and storage
• reporting mistakes or unexpected results
• respect for other students

Build the class Code of Behavior

Start with the situations below.

For each one, write a rule that would prevent the problem without making the course impossible to use.

Situation A: the real password

A lab asks students to compare weak and strong passwords. A student wants to test the password they actually use for email.

Your rule should make it clear that real passwords never belong in classroom tools, worksheets, screenshots, or demonstrations.

Situation B: the interesting IP address

A student notices an unfamiliar IP address while working on a provided packet capture and wants to scan it from the school network.

Your rule should separate analysis of supplied evidence from interaction with a live target.

Situation C: the screenshot

A student captures a screen that accidentally includes another student's name and account information.

Your rule should explain how evidence is sanitized before it is submitted or shared.

Situation D: the lab behaves strangely

A virtual machine or simulation produces an unexpected result.

Your rule should tell the student when to stop, preserve evidence, and ask for help instead of improvising against a wider environment.

Write one enforceable rule for each situation.

Now connect ethics to the CIA Triad

A good Code of Behavior protects the same security properties you learned in Lesson 2.

Consider this rule:

Do not share another student's account information in screenshots.

That protects confidentiality.

Consider:

Keep the original teacher-provided evidence file unchanged and work from a copy.

That protects integrity.

Consider:

Do not run stress tests against school services.

That protects availability.

Ethical behavior is not separate from security engineering. In a classroom, careless behavior can damage the exact properties the course is teaching you to protect.

CIA evidence lab

Use the following fictional classroom incidents. Your job is not to guess who caused them. Your job is to identify the affected CIA property, cite the evidence, and choose a safe response.

Incident 1: public folder

A screenshot shows a class folder configured so that anyone with the link can view files. The folder contains fictional student project notes.

Record:

• CIA property affected
• evidence you can observe
• what the evidence does not prove
• one defensive control
• one Code of Behavior rule that applies

Incident 2: changed configuration

A provided version-history record shows that a robotics configuration value changed from max_speed: 0.45 to max_speed: 1.00 between two approved versions.

Record the same five items.

Do not claim that the change was malicious unless the evidence supports that conclusion.

Incident 3: unavailable service

A synthetic status log shows a course web service returning 503 Service Unavailable for 18 minutes during a lab period.

Again, identify the CIA property and the evidence.

Do not assume the cause was an attack. Availability can fail because of overload, maintenance, broken dependencies, configuration errors, or deliberate disruption.

Incident 4: mixed failure

A fictional shared account is exposed. An unknown user changes a project file and then deletes the original.

This case can affect more than one CIA property. Explain each one separately.

Build an evidence table

Use this structure:

Your evidence column should describe something actually present in the scenario.

Your unknown column should stop you from turning a clue into a story.

The rule-writing test

Return to the Code of Behavior you drafted earlier.

Test each rule with three questions:

1. Can a student tell whether they followed it?
2. Does it protect a real person, system, account, or piece of evidence?
3. Does it still allow legitimate classroom learning?

If a rule says only "do not hack" or "be responsible," rewrite it.

Security policies become useful when they help someone make a decision under pressure.

Career lens

Imagine you are responsible for one of the four incidents above.

Which professional role would likely become involved first?

Possible examples include:

• help-desk or IT support
• security analyst
• system administrator
• network defender
• incident responder
• security engineer

There is no single correct answer for every case. Explain why the role you selected would be useful and what evidence they would need before acting.

Evidence for Lesson 3

Submit three artifacts:

1. Classroom Code of Behavior

Include at least eight enforceable rules covering authorization, privacy, credentials, evidence, and safe lab behavior.

2. CIA Evidence Table

Complete all four incidents and identify at least one case where more than one CIA property is affected.

3. Ethics agreement readiness check

Before the required student and parent/guardian sign-off, identify one rule you would explain at home and why that boundary matters in a cybersecurity course.

Finish with this statement:

The rule that will matter most when I am curious enough to keep going is ________, because ________.

The course is going to give you tools. The Code of Behavior defines where those tools belong.