Effects of a game based cybersecurity skill training in learning cybersecurity among undergraduates

This research investigates the effectiveness of a Capture the Flag (CTF) game-based training module in enhancing students' understanding of cybersecurity concepts. The primary issue addressed is the gap in practical cybersecurity skills among students, despite theoretical knowledge. To tackle this, we developed a CTF web-based game called Script Kiddie Resilience Capture the Flag (SKRCTF) using a five-step gamification approach tailored for educational purposes. The game design process began with aligning the cybersecurity education syllabus from two universities with industry standards. This alignment ensured relevance and applicability. We then deployed a minimum viable prototype (MVP) of the game on an e-learning platform, guided by the Technological Pedagogical and Content Knowledge (TPACK) framework. The game's Pedagogical Content Knowledge (PCK) was validated by four experienced academicians, and its Technology Content Knowledge (TCK) was assessed by two cybersecurity professionals. The game impact was tested on 71 university students through a quasi-experimental design, featuring non-equivalent control groups with pre-test and post-test assessments. Students were divided into cohorts within an academic semester, with the experimental group engaging with the SKRCTF game. Initial results after 12 weeks showed no significant improvement in the experimental group's ability to recognize cybersecurity threats and cryptography patterns. This led to the formulation of 22 null hypotheses regarding the game's effect on novice learners in cybersecurity. In response to these findings, we adjusted the game's guides and challenges and conducted a second experiment. This iteration revealed a slight improvement in participants' abilities to calculate basic cryptographic algorithms and recognize simple malicious code. In conclusion, the research underscores the importance of foundational computer science knowledge, such as operating systems, networking, and programming, for effective learning in cybersecurity. Our findings highlight the cognitive skills necessary for students before engaging in advanced cybersecurity training and demonstrate the nuanced impact of game-based learning on acquiring cybersecurity skills.