Cyber Competitions Prepare the Cyber Security Professionals of Tomorrow

By Bob Bunge, Associate Professor,

College of Engineering and Information Sciences, DeVry University

 The Battle of Waterloo, as the saying goes, was truly won “on the playing fields of Eton.” In our current digital age, our best and brightest young defenders are testing their mettle on the virtual playing fields of cyber sport. Cyber competitions are the warrior games of the networked era — but instead of throwing javelins, racing chariots, or wrestling to the death, today’s competitors exercise modern combat skills like firewall configuration, malware detection, file restoration, and strong user authentication. Success and failure for these high-tech warriors has direct parallels to the experiences of soldiers on historical battlefields – hold the line or lose your country.

 In fact, as a country we are coming to understand how important it is that we train real-world and high-tech warriors.  With Congress currently debating the best approach to cyber security, it is clearly urgent that we quickly learn how to safeguard our virtual information.  Anyone who has suffered identity theft can attest:  as a nation, as individuals, we need protection from crime and espionage online.

 And who will provide this protection?  Today’s youth — the very warriors who are engaged in learning through cyber sport.  You’ll find these warriors doing battle on such playing fields as  National Collegiate Cyber Defense Competition, the United States’ Air Force Association’s CyberPatriot, the U.S. Cyber Challenge, and the Global CyberLympics.  Such landmark events are raising national awareness about the need for increased education and ethical understanding within the field of information security.  And these events also offer the perfect environment for students to put the theories and skills they have learned in their coursework to practical use.

 As a professor at DeVry University and its Keller Graduate School of Management, I have experienced firsthand the important impact of cyber security competitions — as a training ground for future warriors and as a training ground for a career field.  Our government, military, and business employers desperately need an elite band of digital defenders.  DeVry University’s Cyber Defense Club can give any who might be called a taste of this action, and preparation for jobs to come.

A word of warning, though.  I’ve seen it time and again:  students who feel the thrill of victory and the agony of defeat in cyber competitions cannot wait to climb back into the ring.  Being pounded by hackers over the course of a non-stop weekend, all the while being harassed by a fictional “boss” who demands impossible budget rewrites under ridiculous deadlines may not sound particularly fun. Our Cyber Defense Club trains relentlessly all year, however, just to have this opportunity. We wear team khakis, create a business, get overwhelmed by piles of work, see our systems destroyed, rebuild our systems for a better future, and generally have the time of our lives.

You may wonder – why would anyone spend a weekend like this without receiving any overtime compensation? Well, the career compensation to come is reward enough. I’ve witnessed corporate sponsors lurking at the edges of every contest, and Human Resources staff working the lunchroom. Ultimately, the Collegiate Cyber Defense Competition had to pass a rule: no contract offers allowed until after the competition is over. Student-athletes were getting too distracted by recruiters. And still, we have trouble keeping DeVry University seniors on our team because they lose amateur status for their professional IT work prior to graduation.

This is a nice problem to have of course.  And as an added benefit, the cyber security playing field is widening.  In addition to my work with DeVry University’s Cyber Defense Club, I’m now mentoring local high school teams in CyberPatriot. But whether I’m coaching high school students getting ready for college, or college students getting ready for careers to come, I find myself often extending this reminder:  the skills we practice are not just a game.  In many ways, we play for our nation’s future.

Robert (Bob) Bunge is an associate professor in the College of Engineering and Information Sciences at DeVry University. He has nearly ten years of teaching experience in computer information systems, network security and simulation development. As a cyber security and cloud computing expert, Bunge has presented on various subjects at numerous events, including the NWSec Conference and the Washington Association for Skilled and Technical Sciences Conference. He has 5 years experience coaching and organizing PRCCDC.  

Devry Know-How

 

 

 

 

Come join us @ Black Hat USA 2012!

 


Remember that Panoply competition we blogged about last October? We are taking it on the road. The CIAS is very excited to be running the competition for Black Hat USA 2012 attendees. The competition will run Wednesday, July 25th and Thursday, July 26th.  Each day is a separate event with different target sets – you may compete in either day or both days.  Prizes will be awarded to the top three scores from each competition day:  Grand prize:  Black Hat Briefings Pass (free pass to Black Hat USA 2013); Second Place:  256GB SATA3 SSD, Third Place:  32GB 3.0 USB flash drive.  NOTE:  Competitors may receive a maximum of one (1) grand prize per person.

What is Panoply? 

This is a timed security competition that combines network assessment and network defense into a single event. Participants compete for common resources, planting their flags in services to claim ownership and then defend those service from the other players. A scoring engine will perform random checks to verify that services are running and the functionality of the services.

Who Can Play and how do I register?

The Panoply competition is open to any Black Hat USA 2012 attendee excluding employees of Black Hat and the University of Texas San Antonio. To play, simply stop by the NCCDC/CIAS booth outside the Octavius Ballroom to fill out a registration form. Competitors must provide their own assessment platform and tools -  use of any open-source or commercial assessment, exploitation, or scanning tool is allowed.

Looking forward to seeing you there!

Structuring a Good CCDC Team

Structuring a Good CCDC Team by Brandon R. Brown MSBA, PMP, CISSP, CCNP

As a coach, organizer, and collaborator of CCDC event, I have spent a lot of time strategizing about my team’s structure. Before you can put forth a practice, you have to have a goal. Like with any project, you have to have a plan that will need to be both structured and flexible. All of that said, it is best to put together an outline similar to a project or work flow for that practice.

Create themes for your team. Structure your practice around a certain organization such as medical, financial, defense, aerospace, small business etc. Having a firm understanding of the applicable laws, regulations, technologies, and applications of those industries will give you a leg up if you come across them in a competition. From a technical perspective, look at the dynamic of applications used in that space. This will dictate the logical data flow from the top down.

It is good to have a “base structure” for your team. For example, do you have team members that are dedicated to Microsoft operating systems? This can be said for Linux, Juniper, Cisco, etc. etc. etc….. Have a lead for each of these technological areas. This lead should be one of the senior people on the team; typically either a junior or senior. On the management end of the spectrum, does your team captain (assuming you have a captain, and I hope you do…) have an organizational plan to handle the business injects? Is he/she handling them alone? Do you have a structured business model for your team?

Finally, practice, practice, practice….. Most competitions I have participated in are not won or lost in the first hour or two much less the first day. Last year at nationals (2011), The University of Washington was not leading going into the final day of the competition. Same at the Western Regional (2011) and West Coast Winter Invitational where Cal Poly Pomona squeaked out a victory over Cal State San Bernardino in the last hour of those competition! The moral of this story is, never give up, don’t quit, and my favorite saying:

Keep Moving!

- Motto of the 2nd Marine Regiment, Tarawa Atoll, November 1943. Nearly 1/3 of the regiment was lost in this battle which was the bloodiest in U.S. Marine Corps history.

Brandon R. Brown

Mr. Brown is a lecturer in the Computer Information Systems department, College of Business, California Polytechnic University at Pomona. He is also the Director of Managed Services for NIC Partners Inc. in So. CA that specializes in K-12 network and system management / security. Mr. Brown has helped to organize several CCDC events through the Western Regional Cyber Defense Competition organization and has run several simulation events at the college level. Mr. Brown is currently progressing toward his PhD in Information Technology with a specialty in Information Assurance and cohort in Cyber Defense Simulation from Capella University.

Don’t Forget the Basics

A word of advice to CCDC teams across the country – it’s easy to get overwhelmed and wrapped up in the details of a CCDC competition, so don’t forget the basics of information security.  Sure it is tempting to get neck-deep in that FreeBSD web server you’re building or to try and catch every little probe a Red Team sends at you.  I’m not saying don’t do those things, I’m saying don’t worry about those things if you haven’t taken care of the basics first.  Every CCDC event is different (that’s one of the great things about the program) so while there’s no magic set of procedures and processes that will win you any CCDC event, there some tried and true security basics that will dramatically increase your chances of winning any CCDC event your team walks into.

  1. Change passwords.  On everything.  Seriously.  If it has an account and a login, you will probably want to change the password.  After years of running CCDC events, we still see teams going into the second or third day of an event with a default password on a router or an admin password that hasn’t been changed.  A weak or default password is like a giant blinking bull’s eye to a Red Team.  So when you take over a network, make changing passwords one of your first priorities.
  2. Secure the perimeter.  If your network is an open door, the Red Team will walk right into it.  Use network firewalls to block incoming connections and limit the services that can be reached from outside your network to the bare minimum.  There’s no reason TCP port 135 should be open the entire world so lock it down.  Don’t have a network firewall?  Then each host just became its own little island with its own perimeter.  Use host-based firewalls to do the same thing – limit access to services wherever you can.  It’s not a bad idea to limit access at both the network and the host level either.   You’re not being paranoid in this case – there really ARE people out to get you (well your systems anyway).
  3. Remove/restrict unnecessary services.  If your server does not need a TFTP service running then turn it off.  Take note of what is required and then turn off any service you don’t absolutely need to address the competition scenarios.  Every service you can turn off or get rid of is one less service to worry about securing and one less target for the Red Team.
  4. Be prepared for contingencies.  Systems get wiped out at CCDC events.  Systems get taken away due to “hardware failures” or “natural disasters”.  So be prepared to restore content quickly if needed.  Make your own copies of critical content where you can – just make sure you store them in a secure manner.
  5. Read injects carefully.  Most injects will tell you what the judges expect to see in your answer.  If they suggest or specify a format, make sure you use it.  If the inject says list the patches applied to each system, be sure to list every system in your report.  Format and content are important as well so don’t ignore them, but if your inject response does not address the questions being asked of you then you will lose points no matter how pretty or well written your response is.

This is by no means a complete list – and it’s not meant to be.  It’s just a reminder that when the buzzer sounds and the keys start clicking, don’t forget to take care of the basics.

“Free” SAN Solutions

Ever wanted to play with a Network Attached Storage device?  Is your team looking for some place to store files, images, injects, VMs?  Have an old desktop/server and a few drives lying around and nothing to do on them?  Consider building out your own SAN.  While you can easily pick up some lower end SAN devices for less than $1,000 there are at least two solutions  that will allow you to build a dedicated SAN using hardware you already have laying around:  FreeNAS and Openfiler.  FreeNAS and Openfiler are software solutions that allow you, in most cases, to take your existing hardware and turn it into a full-featured network storage solution supporting iSCSI, NFS, SMB, AFP, etc.  And you can get them for free.

FreeNAS (http://www.freenas.org/) is a free, open source, network-attached storage operating system based on FreeBSD that includes a web interface, command line interface, support for 10GigE devices, snapshots, replication, and so on.  The software is downloaded as ISO that you than burn with your favorite burning software to create a bootable CD.  Openfiler (www.openfiler.com) is available in both free and paid versions, includes a web interface, support for 10GigE devices, replication, and so on.  The software is available as an ISO as well as pre-built VMWare and Xen virtual appliances.

Both products are fairly simple to install from their ISO versions.  Burn the CD, boot from it, and follow the prompts.  If you’ve ever installed an operating system, this process will be very familiar to you and you can have the basic system up and running in very little time.  The big question you’ll need to answer is what will you use your newly created SAN for?  Let’s face it, network storage is fun to play with but it can also be useful.  Here are some things to consider:

  • iSCSI target for ESX server:  Both products support the creation of iSCSI targets that are can be used as datastores for ESX servers.  This is especially useful when storing many VMs or using VMs with multiple snapshots.
  • NFS:  Both products support NFS which would give your team a network storage capability to share files, folders, and so on.  You can even share CD/DVD drives via NSF.
  • Directory Services:  You can configure your NAS to use authentication services such as LDAP or Active Directory.

Of course performance of your NAS is heavily dependent on the hardware you are using.  Neither solution is very CPU or memory intensive but performance for each is heavily influenced by the NICs and hard drives you are using.  The good news is that even with a single 7200 RPM SATA II or III drive and a gigabit NIC you can get acceptable performance out of either of these products.  And both options support capabilities such as NIC teaming to increase throughput.  So if you’re looking for a network storage solution to use in your CCDC preparation activities, consider giving FreeNAS and/or Openfiler a try.

 

NCCDC requires more than technical skills

While NCCDC is a cyber defense competition, there’s a critical skill set that is sometimes overlooked.  Teamwork!

Most commonly Information Technology people like to work individually.  However, to be successful in this competition, team members must be able to communicate effectively with one another, especially in stressful situations.

Teamwork can make or break your performance in this competition.  A strong team sticks together and can make it through the roughest times.  As the stress kicks in, tempers flare and personality conflicts can occur.   A healthy team spirit is what keeps you in the game.

How do you build a strong team?

  • Define a common set of goals
  • Make sure everyone has a ‘team player’ attitude
  • Take part in regular team building activities to foster cohesion, and build trust and confidence amongst each other
  • Identify roles of each team member
  • Identify and respect team members’ strengths and weaknesses
  • Do not criticize or blame individuals
  • Be responsible and supportive

NCCDC is also an opportunity for companies to recruit individuals.  Representatives from each company will be observing teams during the competition.  One of the most important skills these companies want in a future employee is a team player.

New Alumni Profiles

CCDC attracts some of the best and brightest students from colleges and universities around the country.  Where do competitors go after graduation?  Pretty much anywhere they want to.  CCDC events provide excellent learning opportunities that help develop the skills and capabilities employers need. Stop by and check out our Alumni profiles.  If you are a  former student that has participated in CCDC events, moved on to a career, and would like to be included on our alumni page send me an email expressing your interest.

NCSAM What’s going on in your community?

We are now at the end  of National Cyber Security Awareness Month (NCSAM). What exactly is NCSAM? It is a coordinated effort of the National Cyber Security Alliance, The Department of Homeland Security (DHS), and The Multi-State Information Sharing and Analysis Center (MSISAC). October 2011 marks the 8th year for the initiative, and the theme for the month is “Our Shared Responsibility”.  Each week focuses on a different critical cyber security issue, you can find out more about this on the DHS website: http://www.dhs.gov/files/programs/gc_1158611596104.shtm

There were a lot of things going on this month to raise awareness of cyber security across the gamut of folks that are not in the trenches of cyber security on a daily basis. I took a bit of time this week to see what a few of our sponsors and supporters have been doing within their communities to increase awareness around cyber security, you can see what I found below. Although there is a heightened focus on creating cyber security awareness this month, security is an ongoing issue and these are good resources to look back on as long as they are available.

 Deloitte: Deloitte’s Global Public Sector group interviewed cybersecurity specialists from around the world to gain insight on this cross-border issue. The resulting report, “Cybersecurity: Everybody’s imperative,” provides a global overview of cybersecurity culture and issues from various regions and emphasizes the need for a holistic and transnational solution involving more than technology. The report also suggests that government needs to do its part to encourage accountability and offer incentives for the private sector.

Ultimately, an effective cybersecurity program will have a positive impact on economies and governments around the world, which in turn should result in an increase of global commerce and better interaction between governments and those who are governed. More info: Cybersecurity: Everybody’s imperative

Northrop Grumman: On Oct. 22,Northrop Grumman showcased cybersecurity careers during the 2011 Engineering EXPO & Engineering College Fair presented by Chantilly High School and Chantilly Academy for Fairfax County Public School students grades 7-12. Northrop Grumman’s Paul Seay, director, enterprise architecture and solutions, was keynote for the event and company cyber experts participated in career counseling sessions. Instructors from the Northrop Grumman Cyber Academywill provide demonstrations and workshops that show students how cyber attackers can take control of a computer and gain access to personal information. Northrop Grumman will also feature CyberCIEGE, an interactive cyber defense game developed in partnership with Rivermind, LLC, where students will test their network defense skills in a scenario that will challenge their ability to configure and protect their networks. For more information on the Engineering EXPO, contact: Joan Ozdogan, EXPO Coordinator at jeozdogan@fcps.edu.

Advancing discussion at a national level, Northrop Grumman will sponsor a Washington Post Live Event on Oct. 27 titled “Protecting our Nation’s Assets.” Open to participants nationwide, the live-streamed session will feature thought leaders from government and industry. For more information, go to: www.washingtonpostlive.com.

McAfee: National Cyber Security Alliance, McAfee and CyberSmart! Education Team Up to Bring Cybersecurity Learning Resources to K-12 Classrooms

National Cyber Security Alliance (NCSA) – a non-profit public-private partnership focused on cybersecurity awareness and education for all digital citizens – in partnership with McAfee and CyberSmart! Education, today released several resources for K-12 schools nationwide to teach students about the importance of security and online safety. These free, easy to use cybersecurity resources include posters, activities, and checklists to help students maintain good cybersecurity practices are being released as part of National Cyber Security Awareness Month activities in October.

These resources target two different K-12 audiences – Elementary/Middle School and Middle/High School. The classroom activities and accompanying posters can be found at http://www.staysafeonline.org/in-the-classroom/lessons-and-teaching-materials Additional classroom materials on cyber security are also available at http://www.staysafeonline.org/in-the-classroom.

Microsoft: Microsoft offers six foundational steps each of us can take to help protect our online safety, devices, information, and families as we learn, explore, and interact online. National Cyber Security Awareness Month, Online Safety

Boeing: As part of Boeing’s support for National Cybersecurity Awareness Month, company leaders will offer insights into Boeing’s commitment to the cyber challenge on Boeing.com’s As We See It page each Monday: http://boeingblogs.com/bds/as-we-see-it/2011/10/inspiring-tomorrows-cyber-defenders.html

Digital Defense and Alamo ISSA:  DDI solutions is partnering with the Alamo ISSA (Information Systems Security Association) during National Cyber Security Awareness month to provide community education forums at no cost to the public. DDI will host two of these informational sessions:http://www.prweb.com/releases/2011/10/prweb8872688.htm
Protecting Yourself Online – Wednesday, October 19th, 5:30 – 6:30 p.m.
This session is designed to highlight risks associated with online computer use with real world examples and recommendations for testing and resolving computer security issues.
Child Safe – Thursday, October 20th, 5:30 – 6:30 p.m.
A program designed to educate and provide a place that parents can come to learn about protecting themselves and their families from online threats, both as they exist today and where they are going tomorrow.

 

Panoply Results

The CIAS has held its 2nd Panoply event on October 15, 2011. This competition has all the bells and whistles, literally. Red and blue flashing lights were connected to systems and when a service was acquired they would go off along with a siren. There was also a remote control nerf gun  that could be launched by any team that was able to compromise and control the system it resided on, and some other fun things. Six local colleges from the San Antonio area competed against each other in this invitation only event. The colleges that participated were from the University of Texas – San Antonio, St. Phillips College, San Antonio College, Our Lady of the Lake University, Texas A&M – Corpus Christi and Texas A&M – San Antonio. Our Lady of the Lake and Texas A&M – Corpus Christi brought 2 teams each.

Congratulations to our 1st and 3rd place winners: Texas A&M – Corpus Christi. They were successful in penetrating and maintaining services on several Virtual Machines.

Our 2nd place winner was the University of Texas – San Antonio. They also displayed exceptional skills in obtaining several VMs as well as taking control of our music computer, thus becoming the Panoply DJ’s.

The CIAS would also like to extend our thanks and gratitude to the other participants in this year’s event. We will be gathering feedback to improve and expand this event in anticipation of making it available on a national scale.

20111021-102517.jpg

20111021-102537.jpg

 

Building a virtual practice network

One of the challenges many CCDC teams face is finding enough power, space, and equipment to build out a practice network. To address this issue, teams are increasingly turning towards virtualization – which is a great solution for competition practice sessions. Virtualization gives teams the ability to build out practice servers, workstations, or entire networks using the same core equipment again and again. Virtualization gives teams the ability to reset images back to their original configuration quickly, save images in various states of modification, share images between team members, and re-use images over and over while testing different ways to solve an issue or find the fastest way of securing a given application or operating system. Sounds great, right? So how do you get started?

How you approach building out your virtualization capability will depend on what hardware you have available. If all you have available is a system with 2 GB of RAM then you’ll probably want to use a product like VMware Player (http://www.vmware.com/products/player/). VMware Player is free and allows you to create and run virtual machines on your Windows or Linux system. If your resources are limited, you may only be able to run one virtual machine at a time, but VMware player will give you the ability to create and practice with 32 and 64 bit Windows and Linux operating systems without wiping out and reloading your system every time you want to switch OSes. If you have a powerful system with plenty of RAM you can even run multiple virtual machines at the same time. Virtual machines created with Player are portable as well – you can copy a virtual machine and hand it to a team member to practice with and you can upload images built with player to a dedicated hypervisor like VMware’s ESXi. If you have a number of machines with limited resources you can still build a practice network of systems – just run VMware Player on multiple machines simultaneously.

If you have a spare server lying around, you can create a dedicated virtual machine server. The ideal candidate has one or more multi-core processors, 4 GB or more of RAM (the more the better), and at least several hundred gig of storage. In general, the more memory you have available the more virtual machines you can run simultaneously, but you’ll be more satisfied with the performance if you give each virtual machine access to at least a gig of RAM and only run 3 or 4 virtual machines per core. For example, if you have a quad core system with 16 GB of RAM you can probably get away with running 12 to 16 virtual machines at the same time so long as you’re not running an AV scan or patching all the systems at the exact same time. Once you’ve located your hardware you need to select a hypervisor – the virtual machine manager that will let you create, run, and manage multiple virtual machines on a single hardware platform. There are several free hypervisors (virtual machine managers) to choose from including VMware’s ESXi (vSphere Hypervisor http://www.vmware.com/products/vsphere-hypervisor/overview.html), the Xen hypervisor (http://xen.org/), VirtualBox (https://www.virtualbox.org/), and Microsoft® Hyper-V™ Server 2008 R2 (http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=3512). Be sure to check the hardware requirements and compatibility lists before you choose a hypervisor and feel free to experiment – just because your hardware isn’t “officially approved” doesn’t mean it won’t run that hypervisor with a little tweaking.

Once you’ve built out your virtualization capability – start building virtual machines and practicing. Be sure and check out the Virtual Appliance repository at http://www.vmware.com/appliances/. There you can find pre-built virtual machines with everything from servers to firewalls to PBXs.