Finding security flaws for credits: Leiden University puts students to the test

Hacking your university normally gets you into trouble. At Leiden University, computer science students are rewarded for finding and disclosing vulnerabilities in the academy’s systems.

Discovering, reporting, and fixing weak spots and vulnerabilities in applications or IT systems has become a major task for security experts.

To prepare and teach computer science students about this, Leiden University has introduced a new extracurricular course called Capture the Flag: Cybersecurity in practice.

Capture the flag (CTF) is a type of competition in which participants are challenged to find hidden pieces of information, also known as ‘flags.’ The challenges mirror the tactics, techniques, and procedures (TTPs) hackers use in real life to penetrate the cybersecurity defenses of a company or organization.

“The idea actually came from the students themselves. They were already taking part in capture the flag events, which are essentially hacking competitions, and asked whether they could use a room at the university. They booked a space, ordered pizzas, and got started,” Eleftheria Makri, Assistant Professor at the Leiden Institute for Advanced Computer Science (LIACS), says about the course.

Makri emphasizes that CTF competitions are more than just a game for students. That’s why she decided to turn the students’ enthusiasm into a course, including real-world challenges and credits.

The Security Operations Center (SOC) welcomed the idea.

“This approach fits perfectly with our responsible disclosure policy, which encourages external parties to identify and report vulnerabilities in our systems. We also have a wide range of systems and platforms that students can investigate,” says Roy Kokkelkoren, Coordinator of the SOC.

Students identified several vulnerabilities of the same type. According to Kokkelkoren, it was an issue the university was already aware of, but for which no solution was yet available.

He praised the students’ approach of thinking outside the box: “That fresh perspective is something we can genuinely benefit from.”

The course will continue next academic year with a new group of students in computer science, data science, and artificial intelligence.

Students who participate and complete the course earn two ECTS credits.