KC7: A fun and hands-on approach to cybersecurity learning

Imagine you want to get your driver’s license, but you don’t own a car. You’ve never even seen a car. So you read all about combustion engines and the rules of the road. You take classes on physics, you watch a few NASCAR races, and then you go to take the test. It might not be surprising if you don’t end up getting your driver’s license after that test.

This is much like the current state of cybersecurity education.

Traditional cybersecurity classes and training often start by teaching abstract concepts that don’t apply directly to real-world scenarios, and rarely give students the opportunity to approach these concepts in a hands-on way. This approach can cause students to lose interest and drop out before they even have a chance to understand the field.

KC7, our cybersecurity game, takes a different approach. Students begin by learning how to swim through a cloud-based dataset and then quickly jumping into analyzing multiple intrusions using realistic data, creating a foundation of reasoning and analysis skills. This hands-on approach gives students a taste of the exciting world of security and has several benefits for students interested in pursuing a career in cybersecurity.

KC7 offers direct application to the field.

Unlike traditional classes that focus on teaching abstract concepts, KC7 guides students through practical experience that can be applied directly to a career in the industry – offering them a means of answering the interview question “tell me about a time where you investigated an attack”. In the game, students use the Kusto Query Language (KQL) to analyze real-life data mimicking realistic intrusions. They learn how to compose analytical questions and translate those questions into queries that can be applied to data. Through this process, they develop the same analytical skills used by industry professionals such as Incident Responders, Security Operation Analysts, and Threat Intelligence Analysts.

KC7 increases student engagement by immersing them in real-world scenarios.

KC7 gamifies the cyber security learning experience, making the experience more engaging, fulfilling, and leading to better information retention and sustained interest in cybersecurity.

We ran training sessions with middle and high-school students at Fayette County Public Schools in Kentucky. During the course of the workshop, the students were surprised by the accessibility of the experience, and were thrilled to compete for points against their classmates. At the end of the event the students had to be pulled away from the work, some even going so far as to ask if there was any additional analysis they could do at home – that’s right, middle schoolers were asking for more homework! The students said the KC7 workshop was one of the best field trips they’d ever experienced.

Prior to the event, only 18% percent of students had a strong interest in cybersecurity. Following our event, half of the students had a strong interest in cybersecurity, and 90% were at least somewhat interested in the field. These staggering metrics show how effective the KC7 method for learning cybersecurity can be in sparking an interest in students and inspiring them to look into a career in the field. Often, many of these students never thought security was something they were capable of doing, but they learned they had what it takes thanks to KC7.

The game provides students with a solid reference point upon which to build.

KC7 introduces cybersecurity concepts in a way that students can understand and get excited about. While playing the game, they encounter different attack types, capabilities, frameworks, and general IT concepts. Although the game doesn’t require them to understand the technical minutiae, the students are able to engage with the concepts through gameplay, without even realizing they are doing so. We are consistently amazed at how adept the students become at communicating complex technical and analytical concepts in their conversations with each other.

By the time they are formally learning cybersecurity foundations, they have a strong reference point that can help them understand the fundamentals and retain the information they need to succeed in the field.

In the past few months, we have touched the lives of hundreds of students of all levels through KC7, and we are aiming to reach thousands (even millions) more. We put students in the driver’s seat long before they get to the interview, and we do it by making this experience free and easy to access.