Exercices de Sécurité Informatique
Jean Benoit · HAL (Le Centre pour la Communication Scientifique Directe) · 2017
Teaching information systems security is a difficult problem. It is a vast field and theory alone does not make students capable of securing systems effectively. Play seems to be an interesting learning-by-doing solution.A security exercise is a team-based simulation that puts participants in a more or less realistic situation where they have to attack and/or defend systems. There are several types of competitions with rules and scenarios that are sometimes very complex, designed for the needs of different communities (hackers, students or the military, for example).The benefit of a security exercise is both technical and human. The acquisition and reinforcement of essential security concepts, the in-depth understanding of attack mechanisms, but also proficiency in using technical tools, improve participants’ knowledge. Furthermore, play activates personal skills such as the ability to work in a team and to make decisions with limited information in a short period of time.Organising a security exercise requires a lot of preparation. The target audience, the learning objectives and the detailed content of the exercise – the scenario, game rules and duration – all have to be defined. Its implementation will require the development of a technical platform as well as a set of logistical factors.