Capture the Flag
I soon found just the solution at a cybersecurity summit I attended. In one of the sessions, David Raymond of the US Cyber Range introduced a Capture the Flag (CTF) competition that schools could enter. This CTF was temporarily available to teachers with US Cyber Range accounts (a fee-based service). It would last for three days and students had 90-minute class periods where they would work on the tasks, as well as a little homework time. CTFs take different forms, but most educational ones are jeopardy-style: participants must undertake different problem-solving or programming tasks, and for each task that teams or individuals complete, they are given a flag that equates to points. There are different types of task in CTFs, including cryptography challenges (decrypting or encrypting data), steganography challenges (finding information hidden in files or images), and web challenges (exploiting web pages to find specific pieces of text).
The competition that I signed some of my students up to was free, very easy to join, and would get students engaged for the next few days. I could do this! My introductory computer science students (aged 14–16) were at various places in the curriculum, so I pitched the CTF to a group of four students who were working ahead. These students were novice Python programmers and did not have CTF experience. As they looked over the tasks, there were initially a few questions (What is steganography? What is a packet tracer?), but I would provide encouragement and check-ins on their progress only, pushing them to research their questions themselves.
Benefits
CTF competitions present numerous benefits to teaching cybersecurity. Within 24 hours of introducing the challenge to my students, they were problem-solving, researching, communicating, and collaborating — and there were even points on the leader board! I felt like Gene Wilder in Young Frankenstein when the monster is brought to life by an electrical charge. CTFs provide the perfect opportunity for students to explore and investigate content on their own terms. Instead of me standing at the front of the classroom teaching a lesson on steganography, my students were searching online and discussing how to solve a problem with hidden information. In this way, I also found that I didn’t have to be the expert in the room. I took great pride in watching students write code that exceeded my ability as they took control of their learning, and I instead provided them with relevant content, encouragement, and guiding questions.
In addition to working in class, I found out that students were texting each other in the evenings and continuing to work on the tasks at home. Clearly, you should never underestimate the power of a leader board and points! I know colleagues who have gamified their courses, and the CTF reminded me of how points and challenges can be real motivators. The jeopardy-style format and the hints in the CTF created a challenging yet attainable competition, and a fun way to give students a taste of the skills and understanding required for a career in the cybersecurity industry.
Finally, my students were developing soft skills beneficial to their studies and future careers. Since it was a CTF with limited attempts at each task, coordination and collaboration were important. Students were learning to work together as a team; to communicate and delegate clearly; to persevere; and to explore different approaches to solving a problem, as well as the obvious boost to their computational thinking skills and cybersecurity knowledge and understanding. By the end of the week, my students were in fourth place on the leader board, out of 148 teams!
Cybersecurity education can change the future. It gives the opportunity to learn about protecting your personal information, and it can offer a career in protecting your nation. A CTF or a cybersecurity competition will help you be the change in your classroom
Try it for yourself
uscyberrange.org: Cybersecurity labs, including a web-based CTF platform
teachcyber.org: Organisation that provides cybersecurity resources, training, and support to secondary school educators
cryptologicfoundation.org: Foundation that shares cryptology educational resources
