Light Weight Tabletop Exercise for Cybersecurity Education

Abstract It is often difficult to meaningfully convey concepts like security incident management cycle, information sharing, cooperation, as well as the roles of people, processes and technology in cybersecurity courses. Serious gaming can help solve this problem, since it can provide a more immersive and interactive learning experience than traditional methods. This paper presents a light weight tabletop exercise format that has been successfully used in cybersecurity education to demonstrate these and many other concepts to Master level students in two European universities over the past 5 years. The term light weight is chosen to indicate the low work load and resource requirements for the instructor. The paper provides practical guidance on how to develop and execute such exercises. In addition, it lists observations of concepts and recommended discussion points that have been successfully demonstrated in class using this exercise format.