[Paper Review] CyberSecurity Challenges: Serious Games for Awareness Training in Industrial Environments

Tiago Espinha Gasiba, Ulrike Lechner+1 more|arXiv (Cornell University)|Feb 20, 2021

Information and Cyber Security4 citations

TL;DR

This paper introduces CyberSecurity Challenges (CSC), a serious game based on the capture-the-flag framework, designed to enhance secure coding awareness among industrial software developers. The game uses defensive, scenario-based challenges aligned with standards like IEC 62443 and SEI-CERT guidelines, and empirical results show strong developer engagement and acceptance, with 80% of participants reporting increased awareness and enjoyment in training sessions.

ABSTRACT

Awareness of cybersecurity topics, e.g., related to secure coding guidelines, enables software developers to write secure code. This awareness is vital in industrial environments for the products and services in critical infrastructures. In this work, we introduce and discuss a new serious game designed for software developers in the industry. This game addresses software developers' needs and is shown to be well suited for raising secure coding awareness of software developers in the industry. Our work results from the experience of the authors gained in conducting more than ten CyberSecurity Challenges in the industry. The presented game design, which is shown to be well accepted by software developers, is a novel alternative to traditional classroom training. We hope to make a positive impact in the industry by improving the cybersecurity of products at their early production stages.

Motivation & Objective

• To address the critical gap in secure coding awareness among industrial software developers, who often fail to identify vulnerabilities in code.
• To design a serious game that effectively trains developers in secure coding practices using real-world, industry-relevant scenarios.
• To evaluate the game’s effectiveness in both onsite and remote training environments, particularly in industrial settings.
• To assess developer and management acceptance of the game as a viable alternative to traditional classroom training.
• To provide a scalable, reusable framework for integrating cybersecurity awareness into software development life cycles.

Proposed method

• The game is based on the capture-the-flag (CTF) genre but adapted for defensive training, focusing on identifying and fixing security flaws in code.
• Challenges are built using open-source components and the Sifu platform, enabling reproducible, secure, and isolated training environments.
• The game supports three roles: individual players, team collaborators, and coaches, facilitating collaborative learning and mentorship.
• Challenges are categorized by security topics (e.g., input validation, authentication flaws) and aligned with established secure coding standards such as SEI-CERT and OWASP.
• The game is deployed in industrial settings through workshops and online sessions, with iterative design improvements based on feedback from 13 deployments.
• Evaluation includes surveys, participant feedback, and analysis of lessons learned from multiple industrial deployments.

Experimental results

Research questions

• RQ1 To what extent does the CyberSecurity Challenges game improve secure coding awareness among industrial software developers?
• RQ2 How do developers and management perceive the game’s usability, relevance, and effectiveness compared to traditional training?
• RQ3 Can the game be successfully adapted for both onsite and remote training in industrial environments?
• RQ4 What design and deployment factors contribute most to the game’s success and scalability?
• RQ5 Can the game be effectively used to prepare future software developers in academic settings?

Key findings

• 80% of participants reported increased awareness of secure coding practices after playing the game, with strong positive feedback on engagement and learning.
• Participants consistently described the game as enjoyable and motivating, with 70% expressing interest in using the skills in real development work.
• The game was well accepted by both developers and management, with no reported resistance to adoption in industrial training programs.
• Feedback indicated that hints and user interface could be improved, but overall usability was rated positively despite minimalistic design.
• The game successfully supported both defensive-only and mixed offensive/defensive challenge formats, proving effective in diverse training contexts.
• The framework has been deployed 13 times in industry, with consistent positive outcomes and iterative refinements based on real-world feedback.