Looking Back on CSB’s 24h00 Project
In this interview, we hear from Flavien Marcoux and Alexandre Prost-Romand, two of the four initiators of an ambitious project designed by the Student Union (BDE) of CSB.SCHOOL. Along with Maxime Viratelle and Grégoire Anfrye, they created an immersive crisis management exercise aimed at placing students at the heart of a realistic cybersecurity simulation.
This project, combining technical, governance, and communication dimensions, required significant resources and involved well-known professionals. Here’s a look back at this innovative challenge that brought entire classes together and helped reinforce essential cybersecurity skills.
Can you tell us about the project?
The project was conceived by four friends: Maxime Viratelle, Grégoire Anfrye, Alexandre Prost-Romand, and Flavien Marcoux. The goal was to create a cohesive storyline bringing together a variety of topics to challenge students in a realistic professional context. The scenario placed students in the role of an incident response team responding to a cybersecurity crisis at a fictional civil and industrial water treatment company in the Lyon region.
Up until then, our student association had mainly organized recreational activities, but this time, we wanted to launch something more ambitious and meaningful. We also wanted to create opportunities for students to interact with professionals.
Could you explain more about the scenario and its purpose?
We wanted to design an immersive and realistic scenario. In real life, not everything falls apart all at once — so we included an investigative component to the plot.
Also, we didn’t want to limit the simulation to internal crisis management. It was essential to include interaction with external entities like the CNIL, the prefecture, or even the media.
For example, we invited Didier LAGE, who played the role of the police, and a journalist came by to ask on-the-spot questions. This added an extra layer of pressure for participants, who had to handle external communication under stress.
How did you adjust the difficulty level?
We ran several tests with different profiles to ensure that the event was both accessible and challenging. It wasn’t easy to strike the right balance, especially since we were so deeply involved in the design. We also had to ensure the narrative was coherent and that everything we built made sense.
So your goal was to go beyond a purely technical exercise?
Absolutely. The idea was to balance technical aspects, governance, and communication. We actually produced around 800 pages of documentation! On the technical side, we were supported by Michael JACQUES, and the company Sec Dojo lent us resources to adapt their existing exercise to our project.
How much time did the organization take in total?
About six months. We easily spent 35 hours a week on it — it was practically a second job. The most time-consuming part was fine-tuning the scenario so that it was flexible enough, while still guiding participants where we wanted them to go.
Once the 24 hours started, everything went smoothly. Even though the participants were under pressure, we were quite relaxed because we had a clear roadmap.
How did you form the teams?
We made sure to mix students from all levels. Participants signed up based on their profile — technical, governance, or undecided — and we balanced the teams accordingly. It worked really well, and some students ended up taking roles they hadn’t anticipated, which added a surprising and enriching element to the exercise.
You mentioned team spirit earlier — was that a key objective?
Definitely. The goal was to create a project that included everyone, so that each student could contribute based on their experience. We also wanted to promote collaboration, since working alone isn’t an option in this field. In the end, about 80% of the class took part.
You invited professionals — what was their role?
Yes, we had five or six professionals who stayed the full 24 hours, with others dropping in during the day. Some had crisis management experience, while others were there to observe. We asked them to challenge and support the students, to ask questions, and sometimes to guide them when needed. They fully embraced the exercise and were impressed by how engaged the students were.
What did you personally take away from this project?
This project brought together everything we had learned over the past two years. It also helped build our confidence. It was our way of proving that we could create and deliver something meaningful, thanks to the skills we developed at CSB.SCHOOL.
Finally, what do you see for the future of this event?
The future looks bright. As long as students continue to take ownership of the project, adapt it, and enjoy it, there’s every reason it will continue. There are still so many topics to explore in cybersecurity — and plenty of other formats possible. We’ll be here to support future students if they want to carry it forward.
Continue reading
Understanding and Defending Against Ransomware
Cybersecurity and Civic Engagement
