CounterMeasures: An Interactive Game for Security Training Advised by: Mark Claypool Kathi Fisler Craig Jordan (IMGD) Matt Knapp (CS) Dan Mitchell (CS)

Introduction Computer and network use is growing! Security is getting more important –But where do I learn about it? –How do I practice it? What about a game? –With REAL knowledge and tools –And real-world simulations –That’s actually interesting! Worcester Polytechnic Institute 2

Related Work Books – simple to very complex –Tend to be boring, dry, long, very technical Games – fun, interesting –Not real security skills, just puzzle games Online challenges – try various techniques –Very little help/instruction offered Competitions – Capture the Flag –Good luck getting started at DEFCON! Worcester Polytechnic Institute 3

Architecture & Implementation Worcester Polytechnic Institute 4 Game Elements and Design –Educational –Emphasizes Realism Technical Specifications –Client/Server –Adobe Flex –AIR –Java

Architecture & Implementation Worcester Polytechnic Institute 5

Missions Training 1: Finding your Target –Teaches basics of Scanning a remote System Training 2: Bypassing Authentication –Teaches basics of a Buffer Overflow Attack Training 3: Discovering Passwords –Teaches basics of Format String Vulnerabilities Mission 1: Hacking 101 –Test of all Skills that have been learned Worcester Polytechnic Institute 6

Evaluation Main Goals –Educate Users about Cyber Security –Have fun playing the Game Demographic –General Technical Background Computer Science Information Technology Other related Fields –20 Users in experiment Worcester Polytechnic Institute 7

Evaluation: Design Evaluation –Performance Statistics –Questionnaires Control Group –Given Reading Material Experimental Group –Play through the training missions of the game Both Groups –Pre- and Post- Questionnaires –Play Final Challenge of Game Worcester Polytechnic Institute 8

Evaluation: Setup Environment Setup –WPI Fossil Lab –Two Laptops running Countermeasures –Two Desktops running a shell for Control Group Obtaining Users –Mass to CS and IMGD majors –Solicited participants from a mid-level OS class –Students informed that we needed users to participate in a study for our MQP related to Security Worcester Polytechnic Institute 9

Analysis Worcester Polytechnic Institute 10

Analysis Worcester Polytechnic Institute 11

Analysis Worcester Polytechnic Institute 12 Interest in computer security before experiment Interest in computer security after experiment

Conclusion Game as a teaching tool for computer security can be effective –Shorter amount of time and higher rate of user engagement Interest in computer security strengthened through hands-on training Worcester Polytechnic Institute 13

Future Work Greater depth in scoring and complexity in missions Different forms game could take –Direct extension –Multiplayer –Unix environment Worcester Polytechnic Institute 14