Digital Training for Cybersecurity in Industrial Fields via virtual labs and Capture-The-Flag challenges

Industry 4.0 is creating a mismatch between available workers and the skills necessary for open jobs, especially concerning cybersecurity. In 2022, the global cybersecurity workforce shortage reached 1.8 million unfilled positions. DICYSTECH- is a two-year EU funded project that aims to tackle this mismatch by providing 5 open-source learning Modules for higher education students and ICT technicians through lifelong learning courses. The project also offers users remote access to three virtual laboratories in which learners can view and be experimented with high-end enabling IT technology and cybersecurity measures in simulated industrial contexts. Each of these laboratories has been set up in the form of a cyber-range system providing the trainees a realistic virtual environment, with servers, applications, and networking, for practicing with cyber-defense in an isolated and secure workplace. The whole training is organized as individual Capture-The-Flag (CTF) challenges, in which the trainee can test his competences, follow his score, compete with other trainees, and be motivated to improve his cybersecurity skills. This paper describes the rationale, aims and objectives of the DICYSTECH project and emphasizes the course material and the remote lab that was developed by one of the project partners, namely the Hellenic Mediterranean University (HMU). Finally, the paper discusses the results from the evaluation tests that took place by volunteer trainees over the HMU’s pilot testbed.

I. Introduction

In the modern era where almost, every digital device is connected to the internet and 5G is already commercially available, cutting-edge technology such as ChatGPT is just a small flavor of the amazing things we are going to experience in the next few years. However, technology as being a "double-edged knife" it always has two sides. The other side of the knife is the malicious utilization of technology for delinquent behavior. Hacking, social engineering, and ransomware are just a few examples, recently came to the foreground of our lives, of this different aspect of technology use. People must enjoy the goods of technology but also be aware of the risks it infers. The same risks face the companies –from small to large ones- and often become victims. Thus, it is crucial that people involved in the industry to be adequately trained to face these attacks and eventually prevent them.