Capture The Industrial Flag: Lessons from hosting an ICS cybersecurity exercise

Industrial Control Systems (ICS) are integral to critical infrastructure, necessitating advanced cybersecurity training. Addressing the urgent need for specialized cybersecurity training, this paper details the UK's first Capture-The-Flag (CTF) event tailored to ICS. This event, held in 2023, was designed in a jeopardy-style format, featuring a comprehensive suite of challenges that mirrored real-world industrial vulnerabilities. It targeted a diverse audience, encompassing participants from both industrial and academic spheres, and emphasized the need for practical, hands-on experience in ICS cybersecurity. This paper describes the design considerations, experience, and recommendations to designing similar CTF events. The event highlighted the benefits of incorporating pre-event training to better acquaint participants with terminologies and protocols, specific to Critical National Infrastructure (CNI) and Operational Technology (OT). Providing insights into the event's design, execution, and the unique learning opportunities it presented, this paper contributes valuable perspectives for future cybersecurity education and training initiatives, particularly in enhancing practical skills in ICS security.