Protecting digital assets has become a critical priority for individuals, businesses, and governments. As a result, there is a growing need for efective cybersecurity education that equips individuals with the skills and knowledge to identify, prevent, and respond to cyber threats. In this article, we examine the potential of using innovative educational methodologies, such as Capture the Flag (CTF), for teaching cybersecurity efectively and we propose an innovative educational methods. The platform to support it and an experiment to validate it are currently in progress.
Cybersecurity is increasingly relevant, given that the cost of cybercrime is predicted to hit
8 trillion in 2023 and will grow to 10.5 trillion by 2025, according to the report [
The term Capture the Flag (CTF) denotes a typology of cybersecurity competition that challenges participants to find and exploit vulnerabilities in a (simulated or, more rarely, real) computer system or network. These competitions can be designed to mimic real-world cybersecurity scenarios or, from a diferent perspective, they can be viewed as cyber-puzzles, often containing a recurrent story or theme deeply rooted in the underground culture. The ultimate objective of these challenges is to capture the flag by finding all the hidden information before other participants. CTF competitions are often used for education and training, as well as to evaluate and improve the security of real-world systems.
In CTF competitions, participants must retrieve the so-called “flag”, a particular string of
text hidden in files or sensitive information that can only be accessed through exploiting some
vulnerabilities in the system. It is common to find multiple ways to solve a specific challenge.
Even more, it is possible that 0-days vulnerabilities (i.e., not previously known vulnerabilities)
are found during CTF competitions (see for example [
CTF competitions are an excellent tool for cybersecurity education and training [
CTF competitions can be categorized into various classes: Jeopardy, Attack-and-Defense (A/D), King of the Hill (KotH), Boot2Root and mixed style. A Jeopardy CTF is a series of challenges, of increasing dificulty (and hand in hand worth increasing scores), divided into categories such as web, binary exploitation, cryptography etc...
Upon expiration of the given time, the participants with the highest score win.
In the category A/D, each team is given a server with a certain number of vulnerable services, used periodically by a bot. This bot generates and writes flags on each server. Participants are expected to patch the vulnerabilities on their services, while keeping them working (Defend) and exploit the same vulnerabilities on the other teams (Attack). The final score is computed by counting how many flags each team has stolen, and other parameters to evaluate the goodness of defence. In King of the Hill category, teams compete to gain control of a vulnerable system or network and maintain control for as long as possible. The team that maintains control for the longest time wins. In boot2root CTFs, teams are presented with vulnerable virtual machines. The goal is to gain admin privileges. In the mixed category, all the other type of CTF competitions are considered. Some examples are competitions where all the challenges are obtained from real used applications; as already mentioned, there can be competitions with the objective of finding 0-days. Other CTFs can involve physical devices, such as smart cars or satellites.
Teaching cybersecurity can be challenging, given that the field is in constant and fast pacing
evolution. Relevant aspects must also be taken into account, such as the time and the resources
available to the educators, as well as the target audience. Since the environment and the
challenges contended by a cybersecurity expert change continuously, it can be said that actually
the learning process never ends. The traditional teaching method of cybersecurity, at all levels,
usually involve a lecture-based approach. Lectures on selected topics in cybersecurity are
delivered to the students, depending on the specific goals and the time available to reach
them. The program covered in a month by a group of student already working in IT, with
experience in digital security assessment, will be necessary diferent from the one covered
by a group of high school students in a semester preparing to compete in a CTF. This lecture
based approach can be useful to teach theoretical concepts, but can be lacking in building
specific skills required by the specific goals: for example writing a cybersecurity report after
a penetration test for a company or solving binary exploitation challenges involving a 0-day.
Some skills cannot simply be teached, they must be acquired through experience. For this
reason other hand-on approaches are taken into account when programming an educational
intervention. This approaches focuses on practical exercises where students can gain experience
with the security tools and techniques they will use in the actual job they should be prepared
for. Simulations, laboratories and scenario-based training can all be valid hands-on approaches.
As an useful complement, individual or group cybersecurity projects can be assigned in order to
give the necessary time to understand the problems and the solutions involved in the specific
project. Some example projects can include tasks such as creating a security policy, conducting
a vulnerability assessment, and designing a secure network. Using CTF for cybersecurity
education can be a clever move since it takes advantage of the gamification of the learning
process [
In order to support the adoption of this new method, we are developing a platform to help
us in the endeavour. It is worth noting that online there is a moltitude of resources on CTF
training, as well as cheatsheets, code snippets and learning platforms. Some famous examples
include but are certainly not limited to ”TryHackMe” [
From the 21st of April 2023, the platform as well as the new learning methodology will be tested at Department of Computer Science, University of Bari. Students will be divided in a control group, and an experimental group. Every student was preliminarly tested on knowledge and competencies in cybersecurity: the knowledge, using a quiz, while the competencies using 4 simple CTF challenges to be solved in a given time. Successively, for the time of the experiment (i.e. until the end of the course), the two groups will be subjected to diferent teaching methodologies. The control group will attend regular frontal lectures while the experimental group will use the platform to create and share CTF challenges on the studied topics. At the end of the course, students will be tested again on knowledge and competencies. We expect to see an increase in the competencies in the experimental group and an equal level of knowledge. The acquired evidence will be the basis for appropriate statistical tests to accept or refuse the previous assumption.
This innovative methodology, as well as the proposed platform, can be applied to various contexts, ranging from introductory-level cybersecurity education to university-level courses and professional-level updating courses in the industry. Future work will foster the integration of the present proposal with other architectures for knowledge transfer in the cybersecurity domain [14] and with current methodological and technological frameworks for learning [15, 16].
Andrea Chezzi and Andrea D’Urbano acknowledge the funding received by Deep Consulting S.r.l. within the framework Ph.D. program in Engineering of Complex Systems. [14] C. Catalano, P. Afrune, M. Angelelli, G. Maglio, F. Striani, F. Tommasi, Security testing reuse enhancing active cyber defence in public administration., in: ITASEC, 2021, pp. 120–132. [15] M. T. Baldassarre, V. Santa Barletta, D. Caivano, D. Raguseo, M. Scalera, Teaching cyber security: The hack-space integrated model., in: ITASEC, 2019. [16] V. S. Barletta, F. Cassano, A. Marengo, A. Pagano, J. Pange, A. Piccinno, Switching learning methods during the pandemic: A quasi-experimental study on a master course, Applied Sciences 12 (2022) 8438.