This page hosts a framework that adds a story to an 11 week cyber security course. Students of the VM play the part of a new IT security employee at a company and are asked to complete a number of security tasks, for which they receive flags. The user can send the flags they find to a number of different characters to move the story along in different ways. As the story unfolds they find deceit, corruption and ultimately murder, and their choices lead them to one of three different endings. Our framework for running the story and the exercises is completely contained in a single VM, which the students each download at the start of the course. This means that no backend or cloud support is needed.

More information can be found in the paper Jail, Hero or Drug Lord? Turning a Cyber Security Course Into an 11 Week Choose Your Own Adventure Story, which we presented at ASE17. If you are welcome to reuse any of this material in another course, or just for fun. If you have any questions about the setup of the VM, story, requests for help, power point files, source files, demo code etc. please e-mail me (Tom Chothia).

Screen captures with audio from the lectures can be found here. Version 2 of the virtual machine is available here, this version is 64-bit with the current version of IDA free (relevant for Exercise 5). The original VM, 32-bit, expired IDA, is still available here.