Gamified Cybersecurity Education Through the Lens of the Information Search Process: An Exploratory Study of Capture-the-Flag Competitions [Research-in-Progress

Abstract

Aim/Purpose. Capture the Flag (CTF) challenges are a popular form of cybersecurity education where students solve hands-on tasks in a game-like setting. These exercises provide learning experiences with various specific technologies and subjects, as well as a broader understanding of cybersecurity topics. Competitions reinforce and teach problem-solving skills that are applicable in various technical and non-technical environments outside of the competitions. Background. The Information Search Process (ISP) is a framework developed to under-stand the process by which an individual goes about studying a topic, identifying emotional ties connected to each step an individual takes. As the individual goes through the problem-solving process, there is a clear flow from uncertainty to clarity; the individual’s feelings, thoughts, and actions are all interconnected. This study aims to investigate the learning of cybersecurity concepts within the framework of the ISP, specifically in the context of CTF competitions. Methodology. A comprehensive research methodology designed to incorporate quantitative and qualitative analyses to draw the parallels between the participants’ emotional experiences and the affective dimensions of learning will be implemented to measure the three primary goals. Contribution. This study contributes significantly to the broader landscape of cybersecurity education and cognitive-emotional experiences in problem-solving. Findings. The study has three primary goals. First, we seek to enhance our under-standing of the emotional and intellectual aspects involved in problem-solving, as demonstrated by the ISP approach. Second, we aim to gain in-sights into how the presentation of CTF challenges influences the learning experience of participants. Lastly, we strive to contribute to the improvement of cybersecurity education by identifying actionable steps for more effective teaching of technical skills and approaches. Recommendations for Practitioners. Competitions reinforce and teach problem-solving skills applicable in various technical and non-technical environments outside of the competitions. Recommendations for Researchers. The Information Search Process (ISP) framework may enhance our understanding of the emotional and intellectual aspects involved in problem-solving as we study the emotional ties connected to each step an individual takes as the individual goes through the problem-solving process. Impact on Society. Our pursuit of advancing our understanding of cybersecurity education will better equip future generations with the skills and knowledge needed to ad-dress the evolving challenges of the digital landscape. This will better pre-pare them for real-world challenges. Future Research. Future studies would include the development of a cybersecurity curriculum on vulnerability exploitation and defense. It would include practice exploiting practical web and binary vulnerabilities, reverse engineering, system hardening, security operations, and understanding how they can be chained together.