From the Summer 2021 Issue

Developing Gamification and E-sports for Space and Cybersecurity Skills Development

-William J. "Bill" Britton
Vice President of Information Technology and Chief Information Officer | California Polytechnic State University

Danielle Borrelli
Operations Coordinator & Program Lead for the Trafficking Investigations Hub | California Cybersecurity Institute

Last year, the United States saw a record high number of cyber-attacks impacting businesses, government entities, and individuals. Sophisticated threat actors continue to produce and enhance attacks that cripple critical infrastructure, with SolarWinds being the latest example. According to IDG Research Services, 80% of senior IT and IT security leaders believe their organizations are not equipped to handle cyber threats in various forms. Additionally, Cyberseek estimates that 464,420 job openings currently exist in the cybersecurity industry. The reality is, the United States workforce is both under-equipped and under-resourced to deal with data breaches, leaks, phishing scams, ransomware, malware, and a variety of other issues.

Changing the narrative around cybersecurity, awareness, training, certifications, and engaging the future workforce are imperative. To meet the demand for jobs, we must begin to simplify the mystery of cybersecurity for younger generations and make cybersecurity skills more accessible. One model that shows promise is gamification and e-sports for space and cybersecurity skills development. By engaging middle and high school students from diverse backgrounds in immersive, cyber-based competitions helps prepare a future workforce to be day-one ready for a myriad of cyber-related issues.

The COVID-19 pandemic created the opportunity to disprove some concepts around virtual workplaces and virtual training. With a significant portion of the workforce forced to work from home, while keeping certain skills sharp, the world of virtual training took a significant leap forward. Existing delivery formats were often not as effective and engaging as they could be. In some cases, large-scale training events were cancelled and moved hastily online and the experience was less than enjoyable for attendees. Then, online training organizations began to reassess how content is delivered to its rapidly growing number of users.

At California Polytechnic State University, the annual California Cybersecurity Innovation Challenge (CCIC) had already been scheduled when the pandemic hit.  CCIC is an annual forensic cyber challenge conducted for middle and high school students, which is created and run by Cal Poly students. The competition is known for being a hands-on event, where Cal Poly students build immersive learning sets for the participants to utilize while responding to bad actors in a cybersecurity scenario. The competition was scheduled for June 2020, but in March 2020, the organizers of the competition were directed to work from home, hence, went into complete scramble mode, weighing in on cancelling the entire event or attempting to revamp it for an online format.

“The more the students got engaged, the more non-traditional the organizers became in developing the competitive construct.”

After several long planning sessions, it was decided to move the formerly in-person event to an online environment, but with a twist. Everyone was already experiencing Zoom fatigue, therefore, the focus was on delivering a virtual experience that was laced with learning objectives aligned with the National Initiative for Cybersecurity Education (NICE) framework. The more the students got engaged, the more non-traditional the organizers became in developing the competitive construct. The team started developing game rooms and computer scenarios, puzzles and rubrics that all were focused around a central scenario. The central scenario was fully developed to allow the rooms in the challenge to take on even more personality.

The scenario developed for the 2020 CCIC centered around a commercial satellite that had been hacked via a malware attack. The satellite was eventually forced out of orbit and then returned to earth. All this background information was provided to the competitors as a virtual story that they participated in. Characters were developed and came to life in the form of a virtual “whodunnit” game (much like a modern version of electronic Clue). The satellite crashed to earth and the competitors were given access to part of the satellite payload to conduct forensic analysis and determine what caused the spacecraft to go silent and deorbit. Additionally, the teams then had to conduct analysis of the downstream database to determine if malicious code or packages had been sent from the spacecraft to the user. Remember, these are middle and high school students executing this game.

The more the development team began creating, the more the competition became innovative in the ways it delivered concepts to the participants. The CCIC team also developed incredible preparation packages for the teams to practice with.  The entire event was moved into an online Amazon Web Services (AWS) cloud environment, allowing each team to stand up their own server for their operating environment. The competition went as scheduled and included more than 500 students. CCIC 2021 is set to quadruple in size, which would have been impossible before in an in-person environment.

Moving into a post-Covid world, while still engaging students in an online, virtual environment, demands engaging content and experiences. One of the core lessons repeatedly learned is that youth today are used to building online communities, attending courses and trainings virtually, and gamified experiences on most digital platforms. Programs that seek to meet youth on this level successfully inspire them for whichever career choice is embedded in the program. According to Edgar Dale’s Cone of Experience, gamified, hands-on learning enhances the retention of knowledge up to 90 percent, while lecture-based learning varies around 5 to 20% retention. This becomes important when providing a challenging, learn-by-doing, experience that is not passive, but active. Active learning makes activities relatable.

“According to Edgar Dale’s Cone of Experience, gamified, hands-on learning enhances the retention of knowledge up to 90 percent, while lecture-based learning varies around 5 to 20% retention.”

According to the Octalysis Framework for Gamification & Behavioral Design, when learning, activities and competitions are gamified, participants are able to find meaning, and it stokes curiosity and preparedness for the unpredictable. As this translates to cybersecurity workforce development and skill exploration, effective and engaging experiences cannot be overstated. According to the Information Systems Security Association and Enterprise Strategy Group, only 38% of cybersecurity professionals say their workplace provides relevant training. In order to increase this number, as well as engage the future workforce, gamification ought to be on the forefront in all relevant modalities.

Another crucial lesson of cyber competition development and the continuous expansion of gamification in cybersecurity workforce development is e-sports. While e-sports is largely relegated to video game competitions, an expansion to cyber competitions would bring the excitement and importance of such events to an increased level. Currently, the e-sports industry has over 500 million viewers/participants and has evolved into a multi-billion dollar industry (Newzoo). Individuals with an interest in cybersecurity and gamers often walk in the same circles, and with the marriage of the two industries, building enthusiasm and a following around cyber skills and workforce engagement would be significant. When students experience cybersecurity in a hands-on modality that impacts kinesthetic learning, they understand more holistically the real-life dynamics of cyber careers and professions. Cyber competitions that require and test these skills have the ability to span a wider audience. In developing a holistic engagement strategy for cyber competitions, like the CCIC, immersion-based training incorporating e-sports improves skill-set development, and subsequently, workforce development.

Another crucial component of building a future cybersecurity workforce is diversity and inclusion. As is repeatedly shown, organizations and companies that prioritize workplace diversity often outperform ones that do not (McKinsey and Company). This is critically significant for the cyber industry. According to the International Consortium of Minority Cybersecurity Professionals and the Center for Cyber Safety and Education, in the U.S. cybersecurity industry, nine percent of workers self-identified as African American or Black, four percent as Hispanic, eight percent as Asian, one percent as American Indian or Alaskan Native and Native Hawaiian/Pacific Islander, and four percent self-identifying as “Other.” Additionally, women only represent 15 percent of the cybersecurity workforce. To mitigate the current status quo, CCIC 2021 is working to engage underserved communities through a new initiative, Cyber to Schools (CtS). CtS is a California Cybersecurity Institute (CCI) program that emphasizes Cal Poly’s Learn by Doing philosophy and works to prepare the future workforce for the digital revolution and careers in cyber and space industries. With a focus on training students and reaching underserved cyber communities, this program strives to highlight a non-traditional approach to learning through curriculum and professional certificates that prepare students for future careers. Participants obtain skills in cybersecurity, digital literacy, and cloud-training. In doing so, diverse populations are exposed to cyber-centric careers, acquire professional skills prior to college/workforce entry, and obtain another avenue for social mobility to occur throughout their lifetime. As the threat landscape continues to develop and adjust to heightened security measures, so should the professionals in the cyber landscape. We live in an era where no business and no individual is exempt from risk, and as technology continues to evolve, so should the workforce at-large. This includes both cyber training and certifications for reskilling and up-skilling the workforce, and engaging the youth of today and professionals of tomorrow in cyber centric careers and skill sets. Engaging youth when they start college is too late. Programs that target middle and high school students at their level of interests and learning style open the door to increased career pathways. Utilizing gamification and e-sports elements in cyber competitions shows significant promise for heightened awareness, learning, and job placement. As highlighted with the CCIC, such programs enhance the retention rate of participants, kickstart their skill sets and widen their opportunities for employment and social mobility. lock William J. “Bill” Britton Danielle Borrelli

William J. “Bill” Britton
Danielle Borrelli

Leave a Comment