A Gamified Learning Approach for IoT Security Education Using Capture-the-Flag Competitions: Architecture and Insights

Cybersecurity is one of the most critical issues for Internet of Things (IoT) systems today and in the future. Therefore, it is essential to educate students about cybersecurity and provide them with the skills needed to design and protect secure IoT systems. We share the experience we gained using a gamified learning approach to IoT security by integrating Capture the Flag (CTF) competitions into our university course. During the semester, students form teams and compete against each other in hacking various educational systems designed in a practically relevant way on our CTF platform. In our paper, we introduce the architecture of the CTF platform and provide student feedback on its effectiveness in teaching IoT security. The evaluation reflects student feedback over three semesters. We also share our lessons learned from creating and maintaining the CTF platform and discuss ideas on how to improve it further. Overall, the students engaged extensively in the CTF, had positive experiences with the provided platform and challenges, and were highly satisfied with our teaching approach. Based on the positive feedback, we believe our approach is an effective way to educate students in IoT security, and we encourage others to adopt this method.