Enhancing cybersecurity education using Capture-the-Flag

24 Jul 2017

During the Spring semester of the 2016/2017 academic year, I collaborated with Salvatore Petrilli (Adelphi University, Mathematics) on a study that investigated if realistic gamified simulations of cybersecurity attack scenarios enhances outcomes of cybersecurity education. Such simulations are increasingly popular in cybersecurity training and are referred to as Capture-the-Flag (CTF) sessions.

Intuitively and anecdotally, the answer is affirmative. It only makes sense that playing a game based on realistic scenarios has a positive outcome of a player’s abilities.

However, as important as intuition is, science looks for measurable facts. Our study was designed to look at a few criteria:

1. Do students enjoy the subject matter more by participating in a CTF?
2. Does participating in a CTF deepen understanding of theoretical cybersecurity concepts?
3. Does participating in a CTF develop offensive and defensive cybersecurity skills?

While our sample size was relatively small, the study confirmed that participating in a CTF does indeed, through enjoyment and engagement, students are willing to spend more time on mastering the practical skills discussed in class. Our research were less definitive about deepening theoretical understanding, but we are currently designing a follow-up study that focuses on those aspects.

Based on our study, we wrote a paper that will be published in the conference proceedings of the Special Interest Group for IT Education (SIGITE) and Research in Information Technology (RIIT), which is part of the Association for Computing Machinery (ACM).

When the paper is published, I’ll post full details here.