This month’s denial of service attack on popular websites serviced by Dyn provided a real world example for Michael Maldonado’s cybersecurity class at McNair Middle School in Southwest Independent School District. He opened class with a discussion of the vulnerabilities that led to the hack, followed by measures that can be taken to prevent such attacks in the future.
Then, instead of turning to computer screens to discuss the concepts further, Maldonado turned the class over to a card game called Cyber Threat Defender. The kids sprang from their seats and rushed to gather decks of cards bearing words like “firewall,” “power outage,” and “laptop computer.”
The game – clearly a hit with the kids – was developed by University of Texas at San Antonio’s Center for Infrastructure Assurance and Security (CIAS).
Professor Larry Sjelin, CIAS’s director of gaming, helped develop the game. He’ll be the first to tell you he’s not a tech guy. His background, like Maldonado’s, is in history. However, both stressed the point that cybersecurity isn’t just for tech geeks anymore.
Give any cybersecurity professional the chance, and they will remind you that it is our collective responsibility to create a secure digital nation. Each uploaded file, each cloud account, each web cam represents a potential entry portal for hackers, malware, viruses, and those intent on creating chaos.
Sjelin sees the game as part of a “culture of security.” He likens its message to that of Smokey Bear who reminded us to do our part in preventing forest fires. CIAS is not the first to try to use a game to spread a message.
“Really the problem that we saw was that they weren’t fun,” Sjelin said.
Cyber Threat Defender is modeled after the card game Magic: The Gathering. Each card has a function reflecting the concept or object printed on it. Students build and fortify their networks using “defense” cards, and try to out-defend their opponents as various “event” cards are played. It’s designed for two players, but can easily adapt to six.
After testing it on students at a local middle and high school in Colorado, Sjelin and his team were convinced of the game’s appeal. That appeal was obvious in Maldonado’s classroom. Terms like “budget increase” and “anti-malware” were humming feverishly in the air. As I tried to ask questions, it became clear that I was bothering the students, who had deeply immersed themselves in the game.
“I would play this at home. I just need to teach my family how to play,” said Trey Cano, 12.
Cano came into the class knowing that he wanted to go into cybersecurity one day. Kassidee Webb, Cano’s opponent in a round of Cyber Threat Defender, was not as enthusiastic at first. Now nine weeks into the school year, she has decided she wants to go into the field as well.
That’s the idea: to engage kids at a young age and to engage those who might not see themselves as tech career types.
The cards demystify the vocabulary and concepts, which widens the subject’s appeal.
“You see it working,” Maldonado said. “It becomes much more real.”
Even Maldonado admits that when the idea of a cybersecurity class was proposed, he didn’t want to take it on. It wasn’t until he took a class on digital forensics that he started to get excited about the possibilities. He is relatively new to the field, which is constantly changing. He is learning with the kids with every new hack, and every advance in cyber defense – There never seems to be a dull moment in what is becoming one of our nation’s primary defense concerns.
In addition to the universal need for cyber-safety awareness, it’s an excellent job market. UTSA strategically chose cybersecurity as one of its primary research areas due in part to the high likelihood of graduate employment. Even if grads don’t work for the government or a large tech firm, virtually all businesses are trying to stay ahead of their vulnerabilities.
“Everyone has a cybersecurity angle,” Sjelin said.
The game generated abundant enthusiasm in Maldonado’s students. It also helped students visualize the various concepts. For instance the “firewall” card was placed in front of the computer cards.
“I find it much easier for them to understand the concepts when they see it,” said Maldonado.
To illustrate the ubiquity of cyber threats and defenses, Sjelin and his team have developed bonus packs to supplement the 54-card starter packs. Sponsors can pay to have their product or business on a card, with an explanation of the role they play in cybersecurity.
The sponsorships allow CIAS to provide the game to schools free of charge. Right now schools in Southwest ISD, Colorado, and Virginia have packs of cards for their students to utilize, as do universities and community colleges in Illinois. After printing 1,000 decks in its first run, CIAS has now doubled up on production.
“We even have a deck in the White House,” Sjelin said.
Sponsorships only go into cost recovery for the production of the game. CIAS is prohibited from making a profit off the game.
The growing demand is evident in Maldonado’s classroom as well. What started as an extracurricular club five years ago has now expanded to five full classes of 6th through 8th graders.
