Capture-the-Flag challenges in higher education assignments : Influencing factors and requirements in development and user experience

Abstract: Due to digitalization, computer systems have become integral to every aspect of oursociety. Not all the software and systems behind the wave of digitalization are securelydeveloped, tested, or properly configured and are, therefore, vulnerable to attacks. Thebest way to protect ourselves is through increased awareness about these threats, wherelaboratory exercises are an excellent way to teach about the practical aspects of thesethings. To better understand what makes an excellent cyber security exercise, this thesisaims to develop a CTF-based laboratory exercise for the course Ethical Hacking atKarlstad University and analyze requirements and how different factors influence thedevelopment and user experience. To do this, we set up an environment for hosting,designed and implemented the exercises, and created questionnaires to gather partici-pant data. As a result, we have created a list of 3 requirements and 4 critical factorstogether with an analysis of how they influence the development and user experience ofthe exercise. The most important results were that a correlation between difficulty andhow much the participants liked the lab was found, questionnaire options should not betoo broad since that makes the analysis of them less accurate, and distributing flags inweb environments is more complex than we first assessed.