Capture the Flag competitions for Higher Education

To cope with the shortage of cybersecurity professionals, companies, government organizations, military institutions and, finally, academia have launched their cybersecurity training programs to teach prospective cyber-defenders how attackers think and work. In this paper, we present our experience, as educators, in introducing Capture the Flag competitions and ethical hacking among university students; initially only in an informal context, and then as part of a Computer Security class. Thanks to a Boeing company grant, we had the opportunity to organize training paths and final competitions for our students for three consecutive years and report some results in this paper, sharing some pros and cons we experienced. We hope the lessons learned might be helpful for other instructors willing to follow a similar path.