, SecurityFocus 2006-06-01
Story continued from Page 1
Called together by Lance Hoffman, a computer science professor at George Washington University, and Ronald Dodge, a Lt. Colonel and professor at the U.S. Military Academy at West Point, a group of computer-security professors and graduate students discussed the future of such exercises.
Everyone agreed that the competitions should be formalized, but one participant--Greg B. White, director of the Center for Infrastructure Assurance and Security (CIAS) at the University of Texas at San Antonio--feared that the process would stall.
"The first thing that happens when you get a bunch of academics together is they want to form a committee," White said. "We--three schools in Texas--decided to jump start the process and have a regional competition."
Along with Texas A&M and UT Austin, White created a regional Texas competition pitting five schools against each other in a three-day competition in April 2005. Taking lessons from the military's CDX competitions, the annual Capture the Flag tournament at DEFCON, and a few smaller academic exercises across the country, the universities decided to create a defense-focused contest, and called it the Collegiate Cyber Defense Competition.
The main focus of the collegiate competition, as well as the high school contest, is locking down an insecure business network in the face of an attack.
"When students come in, they are given a network that is up and running, but we don't guarantee that it is secure," White said. "When a student graduates and joins the commercial sector, that is what they are going to face most likely--an insecure network."
Both the college and high-school competitions use a neutral team of attackers, known as a Red Team, to represent online criminals that might infiltrate a company's network. An automated scoring system keeps track of the reliability of any services required by the current scenario, the success in detecting and mitigating an attack, and special bonuses for meeting seemingly random business goals from the fictitious company's management.
Random events also spice up the competition, said Doug Jacobson, associate professor of electrical and computer engineering for Iowa State, who ran the High School Cyber Defense Competition.
"We threw in anomalies," Jacobson said. "In a moment's notice, the CEO says that they want seven new users. Or a cable breaks. Saturday morning, we had a fire alarm, and the pseudo fireman did a few things, and the students had to come in and figure out what was done. We had those types of events going on throughout the exercise."
The contests are not about creating the ultimate secure network--such a beast just does not exist, stressed QCI's Carr, who mentored the Valley High School team.
Each team had to deal with requirements that gave an advantage to the attackers, such as run an old version of Red Hat Linux and have a Mac Mini as part of their network in addition to the seven other computers required by the rules. The Valley High School team, which won the Iowa high-school competition, used Windows 2003 running ActiveDirectory, FreeBSD, Windows XP, ALinux, and Mac OS X.
"Coming from larger environment, we (the mentors) know there is no such thing as a 100 percent Windows or Linux environment," Carr said.
In the end, the contests are about dealing with the messy real world, said White Wolf Security's Rosenberg.
"Is it stacked in the hackers favor? Of course it is," Rosenberg said. "We want the students to take a beating. Far beyond teaching students how to lock things down, we teach them how to get through an attack."
The commercial sector has already started looking at the events as a good training exercise. Corporate security professionals are already a staple at the annual Capture the Flag event at the DEF CON hacking conference, which brings together eight teams to find vulnerabilities, attack each others networks and defend against their opponents' attacks.
The SANS Institute completed a trial run of a competition that will take place during the training group's conferences, said Rosenberg.
Both the high-school and college competitions expect to expand in 2007, given the overwhelming interest in the programs. Iowa State's Jacobson expects the number of Iowa high schools that enter the competition next year to double, while UT San Antonio's White hopes to hold 8 to 10 regional competitions in 2007. By 2008, he expects the CCDC to have a governing body in place to create standards for the regional competitions and to manage the national tournament.
In the end, the competition is about training the next generation of network administrators and security engineers, UT San Antonio's White said. He hoped that companies would look at the contests as a fertile place to fill out their ranks.
"It will also be a great recruiting tool," White said. "We have some of the brightest security geeks on the planet at these events."