Capture the flag to capture interest

By Nancy Stevens. Posted

Originally published in Hello World Issue 18: Cybersecurity, March 2022. All information true at the time of original publishing.

Nancy Stevens shares her classroom experience with using a Capture the Flag competition to engage students with cybersecurity concepts

I had intended to look into a cybersecurity competition for my students for quite some time, but this was getting pretty comfortable at the bottom of my to-do list as competing priorities took over. Pandemic teaching and learning is tough, though, and by the spring of last year, my district had tried virtual schooling, in-person learning in cohorts, and a hybrid plan that was the worst of them all. I was teaching a number of courses and not only was I discouraged by my failure to get to know my students, I’m not sure that I would even recognise them without their masks. The joy of teaching for me is in taking students on a journey: exploring new content, sharing ideas, and developing a better understanding of the technology in our lives. I needed something that would bring the joy back to the classroom.

Capture the Flag

I soon found just the solution at a cybersecurity summit I attended. In one of the sessions, David Raymond of the US Cyber Range introduced a Capture the Flag (CTF) competition that schools could enter. This CTF was temporarily available to teachers with US Cyber Range accounts (a fee-based service). It would last for three days and students had 90-minute class periods where they would work on the tasks, as well as a little homework time. CTFs take different forms, but most educational ones are jeopardy-style: participants must undertake different problem-solving or programming tasks, and for each task that teams or individuals complete, they are given a flag that equates to points. There are different types of task in CTFs, including cryptography challenges (decrypting or encrypting data), steganography challenges (finding information hidden in files or images), and web challenges (exploiting web pages to find specific pieces of text).

The competition that I signed some of my students up to was free, very easy to join, and would get students engaged for the next few days. I could do this! My introductory computer science students (aged 14–16) were at various places in the curriculum, so I pitched the CTF to a group of four students who were working ahead. These students were novice Python programmers and did not have CTF experience. As they looked over the tasks, there were initially a few questions (What is steganography? What is a packet tracer?), but I would provide encouragement and check-ins on their progress only, pushing them to research their questions themselves.

Benefits

CTF competitions present numerous benefits to teaching cybersecurity. Within 24 hours of introducing the challenge to my students, they were problem-solving, researching, communicating, and collaborating — and there were even points on the leader board! I felt like Gene Wilder in Young Frankenstein when the monster is brought to life by an electrical charge. CTFs provide the perfect opportunity for students to explore and investigate content on their own terms. Instead of me standing at the front of the classroom teaching a lesson on steganography, my students were searching online and discussing how to solve a problem with hidden information. In this way, I also found that I didn’t have to be the expert in the room. I took great pride in watching students write code that exceeded my ability as they took control of their learning, and I instead provided them with relevant content, encouragement, and guiding questions.

In addition to working in class, I found out that students were texting each other in the evenings and continuing to work on the tasks at home. Clearly, you should never underestimate the power of a leader board and points! I know colleagues who have gamified their courses, and the CTF reminded me of how points and challenges can be real motivators. The jeopardy-style format and the hints in the CTF created a challenging yet attainable competition, and a fun way to give students a taste of the skills and understanding required for a career in the cybersecurity industry.

Finally, my students were developing soft skills beneficial to their studies and future careers. Since it was a CTF with limited attempts at each task, coordination and collaboration were important. Students were learning to work together as a team; to communicate and delegate clearly; to persevere; and to explore different approaches to solving a problem, as well as the obvious boost to their computational thinking skills and cybersecurity knowledge and understanding. By the end of the week, my students were in fourth place on the leader board, out of 148 teams!

Cybersecurity education can change the future. It gives the opportunity to learn about protecting your personal information, and it can offer a career in protecting your nation. A CTF or a cybersecurity competition will help you be the change in your classroom


Try it for yourself

uscyberrange.org: Cybersecurity labs, including a web-based CTF platform

teachcyber.org: Organisation that provides cybersecurity resources, training, and support to secondary school educators

cryptologicfoundation.org: Foundation that shares cryptology educational resources


https://teachcyber.org

More articles from Hello World magazine

See more articles

Print

Free - UK only

If you’re a UK-based teacher, volunteer, librarian or something in between, we'll send each issue free to your door.

Digital

Free

Just want to read the free PDF? Get each new issue delivered straight to your inbox. No fuss and no spam.

Buy

From £6

If you’re not a UK-based educator, you can buy print copies from our store.