A framework to improve threat vector analysis through the use of gamification

It is proposed that a Capture the Flag readily adaptable framework can be used to educate the individuals responsible for ensuring the security of the cloud infrastructure. Skills transfer of security principles through gamification facilitates the calculation of a metric concerning the skill level of the players. Gap analysis of essential skills can then be carried out and subsequently addressed by the employer. This CTF gaming framework has been refined through cyber challenge events such as IRISS 2012, Source Dublin 2013, Owasp Latam/EU tours 2013 and Also the OWASP Global CTF 2013. The framework describes a risk assessment process operating at both the network and application layers. It also looks to address security policy aspects and make recommendations based on attack/defence behaviours. Although this is still a work in progress, implementation challenges of the proposed framework when operated in house and when accessible remotely are discussed in this study.