"If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions

Joe Gardiner; Stanislav Abaimov; Jacob J Williams; Feras  Shahbi; Kostas Anastasakis; Partha Das Chowdhury; Winston Ellis; Maria Sameen; Manolis Samanis; Awais Rashid

doi:10.1145/3690134.3694818

"If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

2 Citations (Scopus)

Abstract

Industrial control systems (ICS) are the specialist systems responsible for operating many aspects of Critical National Infrastructure (CNI), including power generation and distribution, water treatment, and transport systems. With the increasing cyber threats against such systems comes a requirement for a suitably skilled workforce to protect them. However, there exists a skills gap in this area. Capture-the-flag (CTF) competitions can provide valuable learning experiences for participants. In this work, we use our experience of running multiple ICS-themed CTFs to prepare a set of blueprints for organizing a similarly themed CTF. We then discuss the implementation of our event, mapped to this blueprint, and then present the results of a participant survey to explore the learning benefits of the event.

Original language	English
Title of host publication	Workshop on CPS&IoT Security and Privacy (CPSIoTSec)
Publisher	Association for Computing Machinery
Pages	27-40
ISBN (Electronic)	9798400712449
DOIs	https://doi.org/10.1145/3690134.3694818
Publication status	Published - 1 Nov 2024

Publication series

Name	Workshop on CPS&IoT Security and Privacy (CPSIoTSec)
Publisher	ACM

Access to Document

10.1145/3690134.3694818Licence: CC BY

Handle.net

Persistent link

Protecting Against Reconnaissance Attacks on Industrial Control Systems: A Moving Target Defense Approach
Samanis, M. (Author), Rashid, A. (Supervisor) & Gardiner, J. (Supervisor), 17 Jun 2025
Student thesis: Doctoral Thesis › Doctor of Philosophy (PhD)

File

Cite this

Gardiner, J., Abaimov, S., Williams, J. J., Shahbi, F., Anastasakis, K., Das Chowdhury, P., Ellis, W., Sameen, M., Samanis, M., & Rashid, A. (2024). "If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions. In Workshop on CPS&IoT Security and Privacy (CPSIoTSec) (pp. 27-40). (Workshop on CPS&IoT Security and Privacy (CPSIoTSec)). Association for Computing Machinery. https://doi.org/10.1145/3690134.3694818

@inproceedings{a0534dcba8984472a5ea05de31611b6a,

title = "{"}If you build it, they will come{"} - A blueprint for ICS-focused Capture-The-Flag Competitions",

abstract = "Industrial control systems (ICS) are the specialist systems responsible for operating many aspects of Critical National Infrastructure (CNI), including power generation and distribution, water treatment, and transport systems. With the increasing cyber threats against such systems comes a requirement for a suitably skilled workforce to protect them. However, there exists a skills gap in this area. Capture-the-flag (CTF) competitions can provide valuable learning experiences for participants. In this work, we use our experience of running multiple ICS-themed CTFs to prepare a set of blueprints for organizing a similarly themed CTF. We then discuss the implementation of our event, mapped to this blueprint, and then present the results of a participant survey to explore the learning benefits of the event. ",

author = "Joe Gardiner and Stanislav Abaimov and Williams, \{Jacob J\} and Feras Shahbi and Kostas Anastasakis and \{Das Chowdhury\}, Partha and Winston Ellis and Maria Sameen and Manolis Samanis and Awais Rashid",

year = "2024",

month = nov,

day = "1",

doi = "10.1145/3690134.3694818",

language = "English",

series = "Workshop on CPS\&IoT Security and Privacy (CPSIoTSec)",

publisher = "Association for Computing Machinery",

pages = "27--40",

booktitle = "Workshop on CPS\&IoT Security and Privacy (CPSIoTSec)",

address = "United States",

}

Gardiner, J , Abaimov, S , Williams, JJ, Shahbi, F, Anastasakis, K , Das Chowdhury, P , Ellis, W, Sameen, M, Samanis, M & Rashid, A 2024, "If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions. in Workshop on CPS&IoT Security and Privacy (CPSIoTSec). Workshop on CPS&IoT Security and Privacy (CPSIoTSec), Association for Computing Machinery, pp. 27-40. https://doi.org/10.1145/3690134.3694818

"If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions. / Gardiner, Joe ; Abaimov, Stanislav ; Williams, Jacob J et al.
Workshop on CPS&IoT Security and Privacy (CPSIoTSec). Association for Computing Machinery, 2024. p. 27-40 (Workshop on CPS&IoT Security and Privacy (CPSIoTSec)).

Research output: Chapter in Book/Report/Conference proceeding › Conference Contribution (Conference Proceeding)

TY - GEN

T1 - "If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions

AU - Gardiner, Joe

AU - Abaimov, Stanislav

AU - Williams, Jacob J

AU - Shahbi, Feras

AU - Anastasakis, Kostas

AU - Das Chowdhury, Partha

AU - Ellis, Winston

AU - Sameen, Maria

AU - Samanis, Manolis

AU - Rashid, Awais

PY - 2024/11/1

Y1 - 2024/11/1

N2 - Industrial control systems (ICS) are the specialist systems responsible for operating many aspects of Critical National Infrastructure (CNI), including power generation and distribution, water treatment, and transport systems. With the increasing cyber threats against such systems comes a requirement for a suitably skilled workforce to protect them. However, there exists a skills gap in this area. Capture-the-flag (CTF) competitions can provide valuable learning experiences for participants. In this work, we use our experience of running multiple ICS-themed CTFs to prepare a set of blueprints for organizing a similarly themed CTF. We then discuss the implementation of our event, mapped to this blueprint, and then present the results of a participant survey to explore the learning benefits of the event.

AB - Industrial control systems (ICS) are the specialist systems responsible for operating many aspects of Critical National Infrastructure (CNI), including power generation and distribution, water treatment, and transport systems. With the increasing cyber threats against such systems comes a requirement for a suitably skilled workforce to protect them. However, there exists a skills gap in this area. Capture-the-flag (CTF) competitions can provide valuable learning experiences for participants. In this work, we use our experience of running multiple ICS-themed CTFs to prepare a set of blueprints for organizing a similarly themed CTF. We then discuss the implementation of our event, mapped to this blueprint, and then present the results of a participant survey to explore the learning benefits of the event.

U2 - 10.1145/3690134.3694818

DO - 10.1145/3690134.3694818

M3 - Conference Contribution (Conference Proceeding)

T3 - Workshop on CPS&IoT Security and Privacy (CPSIoTSec)

SP - 27

EP - 40

BT - Workshop on CPS&IoT Security and Privacy (CPSIoTSec)

PB - Association for Computing Machinery

ER -

Gardiner J , Abaimov S , Williams JJ, Shahbi F, Anastasakis K , Das Chowdhury P et al. "If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions. In Workshop on CPS&IoT Security and Privacy (CPSIoTSec). Association for Computing Machinery. 2024. p. 27-40. (Workshop on CPS&IoT Security and Privacy (CPSIoTSec)). doi: 10.1145/3690134.3694818

"If you build it, they will come" - A blueprint for ICS-focused Capture-The-Flag Competitions

Abstract

Publication series

Access to Document

Handle.net

Fingerprint

Student theses

Protecting Against Reconnaissance Attacks on Industrial Control Systems: A Moving Target Defense Approach

Cite this