Feeds

Cybersecurity contests go national

Those dratted kids

Beginner's guide to SSL certificates

"We threw in anomalies," Jacobson said. "In a moment's notice, the CEO says that they want seven new users. Or a cable breaks. Saturday morning, we had a fire alarm, and the pseudo fireman did a few things, and the students had to come in and figure out what was done. We had those types of events going on throughout the exercise."

The contests are not about creating the ultimate secure network - such a beast just does not exist, stressed QCI's Carr, who mentored the Valley High School team.

Each team had to deal with requirements that gave an advantage to the attackers, such as run an old version of Red Hat Linux and have a Mac Mini as part of their network in addition to the seven other computers required by the rules. The Valley High School team, which won the Iowa high-school competition, used Windows 2003 running ActiveDirectory, FreeBSD, Windows XP, ALinux, and Mac OS X.

"Coming from larger environment, we (the mentors) know there is no such thing as a 100 percent Windows or Linux environment," Carr said.

In the end, the contests are about dealing with the messy real world, said White Wolf Security's Rosenberg.

"Is it stacked in the hackers favor? Of course it is," Rosenberg said. "We want the students to take a beating. Far beyond teaching students how to lock things down, we teach them how to get through an attack."

The commercial sector has already started looking at the events as a good training exercise. Corporate security professionals are already a staple at the annual Capture the Flag event at the DEF CON hacking conference, which brings together eight teams to find vulnerabilities, attack each others networks and defend against their opponents' attacks.

The SANS Institute completed a trial run of a competition that will take place during the training group's conferences, said Rosenberg.

Both the high-school and college competitions expect to expand in 2007, given the overwhelming interest in the programs. Iowa State's Jacobson expects the number of Iowa high schools that enter the competition next year to double, while UT San Antonio's White hopes to hold 8 to 10 regional competitions in 2007. By 2008, he expects the CCDC to have a governing body in place to create standards for the regional competitions and to manage the national tournament.

In the end, the competition is about training the next generation of network administrators and security engineers, UT San Antonio's White said. He hoped that companies would look at the contests as a fertile place to fill out their ranks.

"It will also be a great recruiting tool," White said. "We have some of the brightest security geeks on the planet at these events."

This article originaly appeared at SecurityFocus

Copyright © 2006, SecurityFocus

Remote control for virtualized desktops

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.