Attack and Defend: Combining Game-Based Learning with Virtual Cyber Labs

With the increasing focus on cybersecurity from both authorities and enterprises, the growing skills gap in cybersecurity is one of the biggest cybersecurity concerns. Therefore, there is an urgent need to motivate young people to choose education and careers in cybersecurity, but also to increase competencies among both students and professionals. At the same time, many of the topics of cybersecurity are well suited for gamification: This is the case for both technical topics, where Capture The Flag competitions have gained wide recognition, but also for the less technical topics such as incident-response. There are already several well-established platforms to support the former, but in most cases, the exercises offered are quite simple (find a flag and get points), and as such do not reflect the complexity of systems to attack/protect, and if more complex scenarios are covered these often are static, and it requires a significant amount of work to create new scenarios. This paper presents the overall architecture of a new platform, designed for user-friendly and automated generation of complex gaming scenarios for learning about cybersecurity. This makes it possible to create very realistic scenarios for training both technical skills and the participants' abilities to act and make decisions in stressful situations. Moreover, it offers the possibility for users to interact with each other, both within and between teams, raising their abilities to communicate and solve challenges. The platform is envisioned with both technical perspectives and game design for learning in mind. This means that the platform is not only able to create realistic virtual labs, but the labs are created based on game scenarios that are considering specific learning objectives. This also makes it possible to create games that go beyond the traditional "point collection” and engage the users in a setting that feels more realistic and absorbing.