Adapting CTF challenges into virtual cybersecurity learning environments

Abstract

Purpose This paper aims to highlight the potential of using capture the flag (CTF) challenges, as part of an engaging cybersecurity learning experience for enhancing skills and knowledge acquirement of undergraduate students in academic programs. Design/methodology/approach The approach involves integrating interactivity, gamification, self-directed and collaborative learning attributes using a CTF hosting platform for cybersecurity education. The proposed methodology includes the deployment of a pre-engagement survey for selecting the appropriate CTF challenges in accordance with the skills and preferences of the participants. During the learning phase, storytelling elements were presented, while a behavior rubric was constructed to observe the participants’ behavior and responses during a five-week lab. Finally, a survey was created for getting feedback from the students and for extracting quantitative results based on the attention, relevance, confidence and satisfaction (ARCS) model of motivational design. Findings Students felt more confident about their skills and were highly engaged to the learning process. The outcomes in terms of technical skills and knowledge acquisition were shown to be positive. Research limitations/implications As the number of participants was small, the results and information retrieved from applying the ARCS model only have an indicative value; however, specific challenges to overcome are highlighted which are important for the future deployments. Practical implications Educators could use the proposed approach for deploying an engaging cybersecurity learning experience in an academic program, emphasizing on providing hands-on practice labs and featuring topics from real-world cybersecurity cases. Using the proposed approach, an educator could also monitor the progress of the participants and get qualitative and quantitative statistics regarding the learning impact for each exercise. Social implications Educators could demonstrate modern cybersecurity topics in the classroom, closing further the gap between theory and practice. As a result, students from academia will benefit from the proposed approach by acquiring technical skills, knowledge and experience through hands-on practice in real-world cases. Originality/value This paper intends to bridge the existing gap between theory and practice in the topics of cybersecurity by using CTF challenges for learning purposes and not only for testing the participants’ skills. This paper offers important knowledge for enhancing cybersecurity education programs and for educators to use CTF challenges for conducting cybersecurity exercises in academia, extracting meaningful statistics regarding the learning impact.

Cyber5Gym: An Integrated Framework for 5G Cybersecurity Training

“…They now support specialized domains such as Internet of Things (IoT) [18], cyber-physical systems [19], smart grids [20], and Information Communications Technology (ICT) systems [12,14,21]. Furthermore, the cyber ranges serve various purposes: research and development, training and education [3,22], and hosting exercises and competitions like Cyber Defense Exercises (CDX) and Capture the Flag (CTF) events [23]. Some other researchers have created flexible, scalable, and easily reproducible cybersecurity environments for training and experimentation by leveraging AI [13], virtualization [3,24], and automation tools, using technologies like Docker, Ansible, and Python.…”

Aporte pedagógico del Aprendizaje Basado en Desafíos a la formación de los administradores de empresas: una revisión sistemática de la literatura (2019-2023)

“…Estudio descriptivo de caso. Cualitativo (Franco, 2023); (Christensen, 2021) (Colombelli, 2021); (Karagiannis, 2020) Método mixto (Lau, 2021); (Lara-Prieto, 2023); (Necchi, 2020) Revisión de literatura (Leijon, 2022); (Conde, 2021); (Gallagher, 2020) Tabla 2: Metodologías utilizadas en las piezas analizadas…”

Framing Gamification in Undergraduate Cybersecurity Education

“…Carvalho et al [20] presented Activity Theory-based Model of Serious Games (ATMSG) which has the objective of "supporting the analysis and design of serious games when a thorough understanding of the characteristics of the game is needed". Based on ATMSG, Karagiannis et al [21], present the COFELET ontology as a way to describe the key elements that such approaches should embrace to assimilate well known cyber security threat analysis and modeling standards as the means to create interesting educational experiences. The COFELET ontology was extended with the additional elements of learning objective, grade scheme and role in [22].…”