Cyber Awareness Challenge: the federal security training game

The Cyber Awareness Challenge simulates the choices that users of Federal Government and Department of Defense information systems make during an ordinary working day. Players move through first-person simulations and mini-games, and the instructional topics of information assurance awareness are presented through those activities.

The storyline gives those tasks a purpose. A hacker, called only the adversary, is targeting federal systems to reach sensitive government information. To capture that adversary, players have to finish a series of tasks that each demand a safe security practice.

Carney, Inc. developed the 2012 version, which was a finalist in the business category of the 2012 Serious Games Showcase & Challenge. Visitors could try it at the contest pavilion, booth 3263, at the Interservice/Industry Training, Simulation and Education Conference (I/ITSEC).

The game relies on many life-like situations to build awareness of information assurance and system security, mirroring the decisions that authorized users make every day. It also measured learning. Completion of the task series, which covers all required and approved information assurance content, is logged, and the data feeds back each player's successes and failures against safe practice.

The Cyber Awareness Challenge continues as a yearly course. A public course page at dl.dod.cyber.mil describes it as an annual refresher of security requirements, best practices and responsibilities. It offers a Standard Challenge, in which the player completes the activities and reviews the information in each mission, and a Knowledge Check Option of 25 multiple-choice questions for people who completed the challenge in the past year. Anyone who has not completed the Cyber Awareness Challenge in the past year must take the standard option. The address of that course carries the label 2026.

Its missions are framed as short exercises in which the right answers earn a cybersecurity tool. The mission briefs cover unclassified information (the tool is an e-mail digital signature), classified information and spillage, sensitive compartmented information, physical facilities, government resources, identity authentication, malicious code (a maze to escape without being infected), social engineering in e-mails, removable media, mobile devices, social networking and website use, such as handling a possible internet hoax.

The Department of Defense's Cyber Exchange training page for the course forwards visitors to a sign-in screen for Defense accounts, so the public course host above is the page that shows the game itself.