Cybersecurity contests go national

"We threw in anomalies," Jacobson said. "In a moment's notice, the CEO says that they want seven new users. Or a cable breaks. Saturday morning, we had a fire alarm, and the pseudo fireman did a few things, and the students had to come in and figure out what was done. We had those types of events going on throughout the exercise."

The contests are not about creating the ultimate secure network - such a beast just does not exist, stressed QCI's Carr, who mentored the Valley High School team.

Each team had to deal with requirements that gave an advantage to the attackers, such as run an old version of Red Hat Linux and have a Mac Mini as part of their network in addition to the seven other computers required by the rules. The Valley High School team, which won the Iowa high-school competition, used Windows 2003 running ActiveDirectory, FreeBSD, Windows XP, ALinux, and Mac OS X.

"Coming from larger environment, we (the mentors) know there is no such thing as a 100 percent Windows or Linux environment," Carr said.

In the end, the contests are about dealing with the messy real world, said White Wolf Security's Rosenberg.

"Is it stacked in the hackers favor? Of course it is," Rosenberg said. "We want the students to take a beating. Far beyond teaching students how to lock things down, we teach them how to get through an attack."

The commercial sector has already started looking at the events as a good training exercise. Corporate security professionals are already a staple at the annual Capture the Flag event at the DEF CON hacking conference, which brings together eight teams to find vulnerabilities, attack each others networks and defend against their opponents' attacks.

The SANS Institute completed a trial run of a competition that will take place during the training group's conferences, said Rosenberg.

Both the high-school and college competitions expect to expand in 2007, given the overwhelming interest in the programs. Iowa State's Jacobson expects the number of Iowa high schools that enter the competition next year to double, while UT San Antonio's White hopes to hold 8 to 10 regional competitions in 2007. By 2008, he expects the CCDC to have a governing body in place to create standards for the regional competitions and to manage the national tournament.

In the end, the competition is about training the next generation of network administrators and security engineers, UT San Antonio's White said. He hoped that companies would look at the contests as a fertile place to fill out their ranks.

"It will also be a great recruiting tool," White said. "We have some of the brightest security geeks on the planet at these events."

This article originaly appeared at SecurityFocus

Copyright © 2006, SecurityFocus