Schneier's "Security Mindset": How Hands-On Experience Shapes IT Security Education

CTFs and Hacking Labs as Learning Environments

The commentary notes that while technical security details can be learned from textbooks, blog posts, or tutorial videos, developing the Security Mindset requires above all practical engagement with the subject. In the early days of IT, most experts entered the field as career changers through hands-on experience, Schneider explains.

To make such experience possible in a legal and protected setting, hacking challenges and CTF competitions have become established. In a CTF, the teams receive intentionally flawed software. They start and network it, then simultaneously try to fix the bugs in their own system while exploiting them in the other teams' systems, the author describes the process.

By now, CTFs have also arrived in academic teaching. "Jede Hochschule, die IT-Security lehrt, hat ein Hacking Lab oder zumindest CTF-artige Aufgaben in den Übungen ihrer Sicherheitsmodule", Schneider writes. University education has thus found a hands-on format that goes beyond pure theory.

From Hobby Lab to Industry

In parallel with academia, platforms like "Hack the Box" and "Try Hack Me" have enabled many people to get into security hands-on. These offerings are explicitly aimed also at career changers without formal security training, the commentary highlights.

The concept has also reached industry, in the form of cyber ranges as a continuing education tool. Schneider sees this as evidence that the need for realistic practice environments has grown beyond universities and hobby platforms into companies and government agencies.

The commentary closes with the question of which learning formats will be necessary in the future to train the next generation of security experts. Schneider provides no definitive answer, but suggests that the balance between theoretical grounding and practical experience needs to be further adjusted.

The full piece is available to heise-Plus subscribers. It is part of a series of publications in which heise Plus discusses fundamental questions of IT security education.

The heise-Plus commentary is embedded in a broader debate about the transformation of the IT security industry. In view of new threats and growing demands on professionals, it is being discussed how training concepts need to be adapted, the author writes.