Cybersecurity Awareness Platform with Virtual Coach and Automated Challenge Assessment

Abstract

Over the last years, the number of cyber-attacks on industrial control systems has been steadily increasing. Among several factors, proper software development plays a vital role in keeping these systems secure. To achieve secure software, developers need to be aware of secure coding guidelines and secure coding best practices. This work presents a platform geared towards software developers in the industry that aims to increase awareness of secure software development. The authors also introduce an interactive game component, a virtual coach, which implements a simple artificial intelligence engine based on the laddering technique for interviews. Through a survey, a preliminary evaluation of the implemented artifact with real-world players (from academia and industry) shows a positive acceptance of the developed platform. Furthermore, the players agree that the platform is adequate for training their secure coding skills. The impact of our work is to introduce a new automatic challenge evaluation method together with a virtual coach to improve existing cybersecurity awareness training programs. These training workshops can be easily held remotely or off-line.

CyberSecurity Challenges for Software Developer Awareness Training in Industrial Environments

“…i.e., code that is free from known vulnerabilities and adheres to secure coding policies. Previous work introduced the CyberSecurity Challenges from a theoretical point-of-view [11,16] and focused on particular aspects [15]. The current work extends previous publications by a presentation of a unified view on the design process, tailoring to the industry's needs and the perceived usefulness of the CSC events.…”

“…According to the first and second design cycles, the evaluation of these CSC events is structured according to the following research questions. For analysis of the survey results concerning the Sifu platform, we refer the reader to [15].…”

“…The present work uses serious games to achieve the goal of raising secure coding awareness of software developers in the industry. Previous work on selected design aspects and a smaller empirical basis on the CSC includes [11][12][13][14][15][16][17].…”

“…However, since untrusted and potentially malicious code will be executed in the platform during the analysis stage, several security mechanisms need to be implemented to guarantee that the players cannot hack it. These challenges were developed in the Sifu/Online design cycle, and further and detailed information on the implementation is available in [15]. For more information about the Sifu platform we also refer the reader to [14].…”

“…We believe that the large amount of neutral answers is also related to player background and the fact that the challenge type is not purely defensive, i.e., it is defensive/offensive, as discussed in section 5. The reasoning for this is based on the better results obtained in the study of the Sifu platform (see [15]).…”