Roppers Academy

Skill in a field is based on the number of iterations of the problem-solving cycle someone has done in the problem space they are working in. Employers struggle with entry-level applicants because normal education pipelines have minimal focus on solving realistic problems, so applicants come in with few of the mental models or skills required to fend for themselves outside the structure, and stricture, of a classroom. 

Capture the Flags, in comparison, are entirely focused on providing participants with deliberate opportunities to practice problem-solving skills. With a new competition occurring nearly every weekend, the most dedicated of CTF players wind up with thousands of hours more “reps and sets”, and unsurprisingly, develop the base and depth of knowledge required to achieve “expertise” long before they enter the workforce. By introducing CTFs and other quantifiable challenges to the rest of the future workforce, educators can expose students to problems that teach crucial problem-solving skills and allow them to gain confidence and experience as they participate in additional challenges. 

There is plenty written about the value CTFs provide to students, with statistics and discussions about gamification, creativity, and teamwork, but it is more important from a workforce development standpoint that we talk about how we can measure the success of a national CTF initiative. As described before, competitions provide a discrete snapshot into a student’s ability at the time of assessment. This quantitative measure of an individual’s ability to solve a wide range of problems can be used to assess the student's progress, their ranking among other students, and the efficacy of pedagogy. Breaking problem types into categories enables even greater fidelity, enabling specific comparisons across general competencies like systems administration and networking, or more specialized skills like binary exploitation and threat detection.

The challenges in each category are given different weights, with more difficult challenges being worth more in the final rankings. There are also mechanisms built in to identify when challenges’ weights do not equate to students’ ability to solve them– whether they are too hard or too easy–  allowing an updating of weights and even more accurate measurements.

A student who plays in their first CTF, regardless of their level of technical experience, will be able to find problems they can solve and learn from, enabling an enjoyable experience due to the low-weighted challenges meant for beginners like them. With an intentional approach to challenge writing, organizers can ensure that every student’s first event is fun and educational. A student with more technical experience will be able to attempt more difficult challenges, and if they solve them, will receive an appropriately higher score. 

When a student sees their initial results, broken down across categories, they can be given a learning plan to guide them towards precisely what they need to get to the next level. With no two challenges being exactly alike, each practice problem helps a student understand another possible approach to take to similar problems. Tracking progress through these practice problems has value, but the ultimate measure of progress is how they perform on their next assessment. A student’s next CTF event can be used to get another snapshot of a student’s ability, giving instructors a clear look into the progress of their students. These assessments can be repeated at any periodicity and provide a clear idea of a student’s progression. 

A cybersecurity professional does not stop learning once they leave school and enter the workforce. It is a profession distinctive for the requirements to stay on top of the changing threat landscape and technology. CTF is the base for life-long learning and remains available for even veterans of the workforce to refresh their skills on a category of problems. Regular participation in competitions will keep a player on the cutting edge of the industry and keep them sharp across a wide range of general skills, even if their current role is more specialized.

But aiming far beyond measuring individuals, we can measure the efficacy of classrooms, grades, schools, states, and even whole countries. This puts significant pressure on school administrations and local governments to make policy decisions that improve their outcomes. While adding yet another standardized test might be a bridge too far, simply comparing participation levels and scores in voluntary events allow us to get deep insight into the state of workforce development. 

As a final note, CTF teams provide an opportunity for teammates, camaraderie, and competition outside typical athletic teams. Existing options for technically minded team activities are Math Olympiad and extremely expensive robotics teams. A CTF team has zero startup costs because of the ability to use already existing or free resources. Students do not need new computers to compete: standard school-issued laptops are more than enough to access web-hosted virtual machines that give them all the resources they need to learn. Students can represent the school in regional and national competitions without leaving the school grounds, and no events require entry fees or expensive uniforms. Teams can even train themselves without the need for a dedicated teacher by leveraging the huge amount of free curriculum material found on the internet and dedicated support forums for technical questions, though of course, a teacher who could help coach and answer questions would be an incredible benefit for students. 

CTF, a free game played from behind a computer screen, is an inherently neutral activity that should not favor any race, ethnicity, gender, or class. This has not been historically true, as a massive percentage of participants are white and Asian males coming from affluent schools with existing CTF programs. A coordinated effort for every school in the country to start and maintain gender-neutral CTF teams would permanently shift this balance to reflect the talent and diversity that comprises the entire country, not just the narrow slice who has benefited from a CTF-backed education up to this point. Everyone belongs in CTF, and so far that has not been the case. 

Getting a CTF team into every middle school, high school, and college in America is something that could be accomplished by 2027 with no cost to the government outside of helping spread awareness. White House support for Code.org and Hour of Code was a watershed moment in opening up Computer Science, that same high-profile support of CTF would permanently solve many of the existing issues in the cybersecurity workforce.