A student gets a shared folder working and asks you to check it. The files open, another student can access them, and everything looks ready to submit. Then you try an account that isn’t part of the project. That account can open the files, too. It can even edit them.

The student may have done exactly what the assignment asked. If the brief only said to share the folder, getting it working was the obvious goal. Security by design brings the missing questions into the assignment early: who needs access, what should they be allowed to do, and how will we check?

You can start with a lesson you already teach. Give students those requirements before they begin, then leave time for them to test their choices. A discussion about why the wrong account can edit a file is much easier to follow when the result is right there on the screen.

What Does Security by Design Mean in IT Training?

In IT training, security by design means planning how to protect a system while deciding how it should work. Students consider who will use it, what information needs protecting, and how it could be misused. Those decisions shape the setup and the tests they run before handing it over.

For the shared folder, students would agree on who can read, edit, or delete documents before choosing permissions. Later, they check whether the setup matches those requirements. Cybersecurity education becomes part of completing the assignment, with something concrete to investigate when the result isn’t what they expected.

Which Security by Design Principles Should Students Learn?

Start with a few security by design principles that students can return to across their courses. Introduce the problem first, then give it a name. Someone who has accidentally overwritten a teammate’s work already has a reason to think about who should be allowed to edit a file.

These secure design practices are a useful starting point:

There’s room for judgment here. Read-only access suits a reviewer, but it stops an editor from doing their job. Ask students to explain whose work a setting supports and what it prevents. That keeps the discussion grounded in the assignment.

How Can Educators Build Security Into Different IT Subjects?

You’ll find opportunities in ordinary coursework: setting up accounts, connecting devices, sharing documents, or building a form. The security by design examples below add a few decisions to that work before students start clicking through settings.

1. Networking: Control Connections and Review Access

Suppose students are setting up a small college network. Staff need internal resources, while visitors need an internet connection. Before configuring anything, have learners sketch the connections each group requires. A visitor’s laptop shouldn’t be able to reach staff records simply because it’s connected to the network.

Ask students to:

• Use firewall rules to allow the connections each group needs.
• Check that staff can still reach their required resources.
• Verify that a visitor’s laptop cannot reach restricted resources.

If the staff connection fails, give students time to trace the problem. Switching off the firewall may make the connection work, but it also removes restrictions they still need. They should find the rule responsible and test the change.

2. System Administration: Manage Accounts, Permissions, and Updates

Give students the job of preparing a computer for a new employee. Include a short description of the employee’s work so they have a basis for choosing permissions. Otherwise, broad administrator access can look like an easy way to avoid setup problems.

Build three checks into the assignment:

• Everyday access: Can the employee do their work using a standard account?
• Administrator access: Which setup or maintenance tasks need permission to make wider system changes?
• Updates: Have relevant security patches, which fix known weaknesses, been applied and the required applications checked afterward?

Ask for a short handover note explaining what was changed and anything left unresolved. Another student should be able to pick up the computer and understand the setup without guessing why particular permissions were granted.

3. Cloud Computing: Check Who Can Access and Share Data

Use a fictional project with two types of documents: working files for the team and a finished document intended for public viewing. Ask students how they would organize them before uploading anything. A public document and an internal draft may sit alongside each other, but they shouldn’t automatically have the same sharing settings.

Then test a sharing link from a different account. Does access depend on the recipient’s permissions, or can anyone with the link open it? This introduces authorization: checking what a user is allowed to do. Someone can be signed in and still have no permission to open that file.

4. Software Development: Check User Input and Protect Information

A booking form makes a manageable exercise. Before building it, students decide what information they need and what entries the form should accept. Checking submitted data against those rules is called input validation. The checks must run on the server even when the browser performs them, because browser checks can be bypassed.

When checking submitted data, give students several cases to try:

• A valid booking that should go through.
• A negative number of seats that should be rejected.
• A missing required field that needs a clear error message.
• A request to view a booking belonging to another test account.

The last case needs an access check as well as input validation. A correctly formatted booking number doesn’t prove ownership. Using fictional records, students should confirm that an ordinary user cannot retrieve someone else’s booking just by knowing its number.

How Can Hands-On Cybersecurity Labs Put These Principles Into Practice?

Give students a clear task in a separate training environment, using fictional accounts and data. In hands-on cybersecurity labs, they can change a setting, inspect the result, and try again without disrupting everyday systems. Allow enough time for the second attempt. Finding and correcting an unexpected result is part of the work.

When teaching cybersecurity, beginners may need you to demonstrate where the settings are and how to test them. Once they’re comfortable, change one requirement. Can they adapt the setup without repeating the whole walkthrough? Their explanation will help you see where they still need support.

Classroom Example: Set Up a Shared Folder With Appropriate Access

Imagine a student services team preparing an orientation pack. Two coordinators need to update documents, a reviewer needs to read them, and an unrelated account should have no access. Have students write down these requirements before opening the folder settings.

Students need to test with each account. Checking only from an administrator account can hide permission mistakes. Once they’ve recorded the results, tell them the reviewer has left the project. Can they remove that person’s access while keeping everything working for the coordinators?

Ask students to hand in:

• Their original access requirements.
• The permissions they assigned and why.
• Results from each test account.
• The change they made when the reviewer left, followed by fresh test results.

If the reviewer still has access, don’t rush to point out the answer. The account might belong to a group that grants permission separately. Let students follow that possibility and check it. They’ll have a practical reason to remember why changing one permission doesn’t always remove access.

How Should Educators Assess Students’ Security Decisions?

A screenshot of the settings gives you part of the story. You still need to know whether the student tested them and whether the intended users could complete their work. Ask learners to explain their reasoning using their results, including anything that went wrong before they corrected it.

Share the assessment criteria before the exercise:

In cybersecurity skills training, pay attention to what students do after a mistake. Someone who investigates an unexpected result and verifies the fix is showing useful judgment. Their first attempt may have failed, but their notes should show that they understood the problem and corrected it.

Where Do IT and Cybersecurity Certifications Fit?

Use certification objectives to check coverage, then connect them with work students can demonstrate. An objective about permissions can lead to a short explanation, a configuration task, and tests from different accounts. This gives learners practice recognizing the concept and using it when they have a decision to make.

NIST’s NICE Framework supports this planning by connecting cybersecurity work with tasks, knowledge, and skills. A cybersecurity curriculum can draw on that structure alongside exam objectives to describe what students should know and what they should be able to do independently.

How Can Educators Keep Security Skills Connected Across the Curriculum?

Point out the connection when an idea returns in another course. Students who have restricted access to a folder have already tackled a question they’ll meet in cloud storage and application development. The software changes, but they still need to decide who may do what and how to check it.

A shared planning table can help instructors build on earlier lessons:

When reviewing the cybersecurity curriculum, agree on a few expectations instructors can share: students explain their choices, test allowed and blocked actions, and leave usable notes. Each course can use different examples. Cybersecurity education feels more connected when learners recognize the thinking even as the tasks become harder.

Teaching cybersecurity across subjects also takes some coordination. Compare assignment briefs occasionally. If one class expects access checks and another accepts any setup that works, students are getting mixed messages about what completion means.

Conclusion: Make Security Part of Every IT Task

Security by design begins with the assignment brief. When access requirements and testing are included from the start, students have a reason to consider them while planning their work. They also know what they’ll need to demonstrate when they’re finished.

Choose one existing assignment and make those expectations clear. For the shared folder, the coordinators should be able to edit, the reviewer should be able to read, and the unrelated account should stay out. Ask students to show you those results and talk through how they got there. That gives you plenty to teach from.