Every student is familiar with the standard multiple-choice final exam given at the end of almost every course. While these exams can measure the level of understanding of a student to a certain extent, it is easy to wonder if the material covered will really apply to life after college. Dr. Jeff Jenkins took this problem and created an interactive, hands-on final to prepare students for the future. In Fall 2019, he created an escape room for the final exam of his course.
Dr. Jenkins taught the IS 560 course on Information Security Management during Fall 2019. While in the course, students learned about many aspects of information security, including protecting data, becoming familiar with attack vectors, preventing attacks, , and methods of threat modeling.
Originally, the escape room was planned to be small and potentially used as the midterm for the course. However, when Dr. Jenkins was able to secure a few rooms at the old Provo High School, he was given the opportunity to make the escape room bigger and better.
Julian Sookhoo, a TA working on the project explained, “We finally figured out that Provo High School was the best place to do it [because they] allowed us to have essentially 4 rooms. So, we were able to extend this a lot further and that is when the idea came that instead of just doing this as a smaller version for the midterm, [we would] make this full-fledged version for the final and make this more comprehensive and better for the students.”
The escape room was comprised of different challenges that worked together to help students save the country from a fictional cyber-attack. Before even going to the escape room, students had to use a social engineering attack to gain access to an email password to sign up to go through the escape room.
Once at the escape room, they participated in different tasks in each room. Some of these tasks included hacking into Furbies and using SQL injection to acquire passwords, creating password lists based on social engineering to crack passwords, picking locks to receive codes, using cyphers to decrypt messages, and circumventing physical security.
Dr. Jenkins and his TAs tried to make the escape room feel realistic and fun while also creating an environment that would achieve the learning objectives of the course. Julian Sookhoo explained, “That is super natural to Dr. Jenkins. As soon as he would come in, he would throw in a lot of ideas [that were creative and fun] and the struggle was choosing the best idea.”
Through this creativity, students were able to experience and learn in a way that brought hands-on experiences to the classroom. “It empowered the students to apply the knowledge that they had gained throughout the semester into actionable items that they would do in the workplace. Obviously, they wouldn’t be trying to escape out of a room of a terrorist, but they would be able to understand the concepts of what hackers are thinking and know how to mitigate that in the real world.”
Ethan Guinn, a student who was part of the team with the best time stated, “Thanks to the escape room, I learned that anybody can be dangerous with the technologies we learn in the IS program, but it’s more important to use this knowledge to help others stay safe. I also learned that even though we learn much more about how certain technologies work, we are just as (and sometimes more) susceptible to attacks like phishing and compromising personal information if we aren’t careful and protect ourselves against them.”
He continued, “I loved the escape room. I not only deepened my understanding of cybersecurity, but also formed fun memories with my classmates and professors in the IS program. The escape room was far more rewarding and memorable than a final exam.”
Thanks to Dr. Jenkins and his team, students were able to use this unique opportunity to apply their knowledge and realize that they have the skills to be competitive in the workforce.
