Thunder CTF: Learning Cloud Security on a Dime

Nicholas Springer (1); Wu-chang Feng (1) ((1) Portland State University)

Thunder CTF: Learning Cloud Security on a Dime

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2107.12566 v1 pith:6KZVQY7E submitted 2021-07-27 cs.CR

Nicholas Springer (1) , Wu-chang Feng (1) ((1) Portland State University) This is my paper

classification cs.CR

keywords cloudsecurityservicesthundermodelsallowamazonapplications

verification ladder T0 review T1 audit T2 compute T3 formal

0 comments

read the original abstract

Organizations have rapidly shifted infrastructure and applications over to public cloud computing services such as AWS (Amazon Web Services), Google Cloud Platform, and Azure. Unfortunately, such services have security models that are substantially different and more complex than traditional enterprise security models. As a result, misconfiguration errors in cloud deployments have led to dozens of well-publicized breaches. This paper describes Thunder CTF, a scaffolded, scenario-based CTF (Capture-the-Flag) for helping students learn about and practice cloud security skills. Thunder CTF is easily deployed at minimal cost and is highly extensible to allow for crowd-sourced development of new levels as security issues evolve in the cloud.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Measuring and Augmenting Large Language Models for Solving Capture-the-Flag Challenges
cs.AI 2025-06 reject novelty 6.0 of 10

A benchmark and agent for CTF solving, but the agent's retrieval database appears to contain the answers to the test challenges, undermining the reported improvements.

Pith tools