"If You Build it, They will Come" - A Blueprint for ICS-focused Capture-The-Flag Competitions

Industrial control systems (ICS) are the specialist systems responsible for operating many aspects of Critical National Infrastructure (CNI), including power generation and distribution, water treatment, and transport systems. With the increasing cyber threats against such systems comes a requirement for a suitably skilled workforce to protect them. However, there exists a skills gap in this area. Capture-the-flag (CTF) competitions can provide valuable learning experiences for participants. In this work, we use our experience of running multiple ICS-themed CTFs to prepare a set of blueprints for organizing a similarly themed CTF. We then discuss the implementation of our event, mapped to this blueprint, and then present the results of a participant survey to explore the learning benefits of the event.