ASE '17 Workshop Program

Capture the flag (CTF) style events have become increasingly popular events for recruitment, training, evaluation, and recreation in the field of computer security. Today, there exists a vast array of CTF software; this software may be divided generally into game engines and challenge components. Game engines, which determine the overall style of the competition, can be categorized into those which support dynamic challenges and those which support static challenges. A small number of game engines are open and available for any party to develop their own challenges on, though most are proprietary solutions.

Over the course of the last 8 years, the Cyber Defenders group at Lawrence Livermore National Laboratory hosted an annual CTF event for its interns, in the process evaluating different CTF types and engines and ultimately developing data on the state-ofthe- art in this field. While these events resulted in a large degree of success with regard to the goals mentioned above, a critical evaluation of the software both used by the Cyber Defenders and generally across the entire field revealed several shortcomings of current CTF practices. In particular, current software may be improved with regard to challenge realism, costs and accessibility, educational applications, and research potential. Proposed herein is a new game engine which addresses these shortcomings. This paper details the architectures for and current progress towards implementing this game engine.

Cybersecurity competitions are getting more attention as a prominent approach of computer security education in the past years. It is vital to look into better ways to engage beginners in the competitions to improve computer security education. This work collected and analyzed the solutions of about 3600 Capture The Flag (CTF) challenges from 160 security competitions in the past three years. This work identified the security issues that are the most concerning to industry and academia and enumerated the security tools and techniques that are used the most by players. Based on the analysis, this work presented a set of computer security exercises as a downloadable tool package for beginners to try out in an introductory computer security course.

With society’s increasing dependence on technology infrastructure, the importance of securing the computers, networks, data, and algorithms that run our digital and physical lives is becoming critical. To equip the next generation of citizens for the challenges ahead, an effort is underway to introduce security content early in a student’s academic career. It is important that these efforts broaden participation and increase diversity in the field. While many camps and curricula focus on introducing technical content and skills related to cybersecurity, such approaches can prematurely limit how students view career opportunities in the field, potentially limiting those who ultimately pursue it. In addition, it is likely that many problems in cybersecurity can only be addressed in an interdisciplinary manner by those trained in the arts and humanities as well as in technical fields.

This paper describes CyberPDX, a residential summer camp that introduces cybersecurity to high school students. Key to CyberPDX is its focus on the range of societal issues that will be impacted by cybersecurity as well as its coverage of the breadth of roles that students can play to help address them. Through four learning threads taught by faculty in Computer Science, Sociology, and Film Studies, the CyberPDX curriculum spans topics from constitutional law, cyberpolicy, ethics, and filmmaking to programming, cryptography, security, and privacy in order to show students how broad cybersecurity issues are and the many ways they can participate in helping to solve them.

In this paper we argue that narrative and story are important elements of gamification, and we describe a framework that we have developed which adds a story to an 11 week cyber security course. The students play the part of a new IT security employee at a company and are asked to complete a number of security tasks, for which they receive flags. The students can send the flags they find to a number of different characters to move the story along in different ways. As the story unfolds they find deceit, corruption and ultimately murder, and their choices lead them to one of three different endings. Our framework for running the story and the exercises is completely contained in a single VM, which the students each download at the start of the course. This means that no backend or cloud support is needed. We report on the results of qualitative and quantitative evaluations of the course that provides evidence that the story increased student engagement and results.

Total Recon is a hands-on cybersecurity exercise designed to teach about network reconnaissance, using a movie theme to make it more exciting for students. Students use nmap and netcat (nc) to investigate hosts on a large network. The multiple levels of the game provide scaffolding that allows students with a wide range of preparation to play the game. The exercise is implemented in the EDURange framework, and according to our surveys, both students and faculty have found the exercises to be very engaging. This short paper describes both the EDURange framework and the Total Recon exercise.

Successful lab designs are a valuable resource that should be re-used and shared among educators and between institutions. A collaborative, community-sourced design effort maximizes the benefit of the effort and expertise required to build and test an effective lab exercise. Unfortunately, infrastructure requirements, heterogeneous operating environments, and the desire to incentivize individual student work pose significant challenges that necessitate frequent updating, redesigning and retesting of assignments, creating a significant maintenance burden. To address these challenges, we present Labtainers: a container-based framework for the development, deployment and assessment of Linux-based cyber security lab exercises. Docker containers present a consistent environment that reduces the need for frequent updates, but with considerably less overhead than VMbased approaches. This enables a modest laptop to host labs consisting of multiple networked components. As such, the Labtainers framework is able to simulate a variety of security-relevant scenarios on a standalone student machine, without the need for elaborate infrastructure. Moreover, Labtainers’ scripting support allows exercises to be customized on a per-student basis, then collected and evaluated automatically on the instructor machine. This capability enables the instructor to assign exercises where each solution is unique to the student with little or no increase in complexity of lab setup or assessment.

This panel is associated with a new, multi-partner effort to develop a cyber security body of knowledge (http://www.cybok.org/). The project seeks to address key questions like: What is in and out of scope of such a CyBOK? What essential knowledge in computer science and other disciplines should be pre-requisite for a CyBOK? This will be an interactive panel and audience feedback will be actively sought for the CyBOK project.