Last year, the United States saw a record high number of cyber-attacks impacting businesses, government entities, and individuals. Sophisticated threat actors continue to produce and enhance attacks that cripple critical infrastructure, with SolarWinds being the latest example. According to IDG Research Services, 80% of senior IT and IT security leaders believe their organizations are not equipped to handle cyber threats in various forms. Additionally, Cyberseek estimates that 464,420 job openings currently exist in the cybersecurity industry. The reality is, the United States workforce is both under-equipped and under-resourced to deal with data breaches, leaks, phishing scams, ransomware, malware, and a variety of other issues.
Changing the narrative around cybersecurity, awareness, training, certifications, and engaging the future workforce are imperative. To meet the demand for jobs, we must begin to simplify the mystery of cybersecurity for younger generations and make cybersecurity skills more accessible. One model that shows promise is gamification and e-sports for space and cybersecurity skills development. By engaging middle and high school students from diverse backgrounds in immersive, cyber-based competitions helps prepare a future workforce to be day-one ready for a myriad of cyber-related issues.
The COVID-19 pandemic created the opportunity to disprove some concepts around virtual workplaces and virtual training. With a significant portion of the workforce forced to work from home, while keeping certain skills sharp, the world of virtual training took a significant leap forward. Existing delivery formats were often not as effective and engaging as they could be. In some cases, large-scale training events were cancelled and moved hastily online and the experience was less than enjoyable for attendees. Then, online training organizations began to reassess how content is delivered to its rapidly growing number of users.
At California Polytechnic State University, the annual California Cybersecurity Innovation Challenge (CCIC) had already been scheduled when the pandemic hit. CCIC is an annual forensic cyber challenge conducted for middle and high school students, which is created and run by Cal Poly students. The competition is known for being a hands-on event, where Cal Poly students build immersive learning sets for the participants to utilize while responding to bad actors in a cybersecurity scenario. The competition was scheduled for June 2020, but in March 2020, the organizers of the competition were directed to work from home, hence, went into complete scramble mode, weighing in on cancelling the entire event or attempting to revamp it for an online format.
“The more the students got engaged, the more non-traditional the organizers became in developing the competitive construct.”
After several long planning sessions, it was decided to move the formerly in-person event to an online environment, but with a twist. Everyone was already experiencing Zoom fatigue, therefore, the focus was on delivering a virtual experience that was laced with learning objectives aligned with the National Initiative for Cybersecurity Education (NICE) framework. The more the students got engaged, the more non-traditional the organizers became in developing the competitive construct. The team started developing game rooms and computer scenarios, puzzles and rubrics that all were focused around a central scenario. The central scenario was fully developed to allow the rooms in the challenge to take on even more personality.
The scenario developed for the 2020 CCIC centered around a commercial satellite that had been hacked via a malware attack. The satellite was eventually forced out of orbit and then returned to earth. All this background information was provided to the competitors as a virtual story that they participated in. Characters were developed and came to life in the form of a virtual “whodunnit” game (much like a modern version of electronic Clue). The satellite crashed to earth and the competitors were given access to part of the satellite payload to conduct forensic analysis and determine what caused the spacecraft to go silent and deorbit. Additionally, the teams then had to conduct analysis of the downstream database to determine if malicious code or packages had been sent from the spacecraft to the user. Remember, these are middle and high school students executing this game.
The more the development team began creating, the more the competition became innovative in the ways it delivered concepts to the participants. The CCIC team also developed incredible preparation packages for the teams to practice with. The entire event was moved into an online Amazon Web Services (AWS) cloud environment, allowing each team to stand up their own server for their operating environment. The competition went as scheduled and included more than 500 students. CCIC 2021 is set to quadruple in size, which would have been impossible before in an in-person environment.
Moving into a post-Covid world, while still engaging students in an online, virtual environment, demands engaging content and experiences. One of the core lessons repeatedly learned is that youth today are used to building online communities, attending courses and trainings virtually, and gamified experiences on most digital platforms. Programs that seek to meet youth on this level successfully inspire them for whichever career choice is embedded in the program. According to Edgar Dale’s Cone of Experience, gamified, hands-on learning enhances the retention of knowledge up to 90 percent, while lecture-based learning varies around 5 to 20% retention. This becomes important when providing a challenging, learn-by-doing, experience that is not passive, but active. Active learning makes activities relatable.
“According to Edgar Dale’s Cone of Experience, gamified, hands-on learning enhances the retention of knowledge up to 90 percent, while lecture-based learning varies around 5 to 20% retention.”
According to the Octalysis Framework for Gamification & Behavioral Design, when learning, activities and competitions are gamified, participants are able to find meaning, and it stokes curiosity and preparedness for the unpredictable. As this translates to cybersecurity workforce development and skill exploration, effective and engaging experiences cannot be overstated. According to the Information Systems Security Association and Enterprise Strategy Group, only 38% of cybersecurity professionals say their workplace provides relevant training. In order to increase this number, as well as engage the future workforce, gamification ought to be on the forefront in all relevant modalities.
Another crucial lesson of cyber competition development and the continuous expansion of gamification in cybersecurity workforce development is e-sports. While e-sports is largely relegated to video game competitions, an expansion to cyber competitions would bring the excitement and importance of such events to an increased level. Currently, the e-sports industry has over 500 million viewers/participants and has evolved into a multi-billion dollar industry (Newzoo). Individuals with an interest in cybersecurity and gamers often walk in the same circles, and with the marriage of the two industries, building enthusiasm and a following around cyber skills and workforce engagement would be significant. When students experience cybersecurity in a hands-on modality that impacts kinesthetic learning, they understand more holistically the real-life dynamics of cyber careers and professions. Cyber competitions that require and test these skills have the ability to span a wider audience. In developing a holistic engagement strategy for cyber competitions, like the CCIC, immersion-based training incorporating e-sports improves skill-set development, and subsequently, workforce development.
William J. “Bill” Britton
Danielle Borrelli
William J. “Bill” Britton
Danielle Borrelli
Leave a Comment