A word of advice to CCDC teams across the country – it’s easy to get overwhelmed and wrapped up in the details of a CCDC competition, so don’t forget the basics of information security. Sure it is tempting to get neck-deep in that FreeBSD web server you’re building or to try and catch every little probe a Red Team sends at you. I’m not saying don’t do those things, I’m saying don’t worry about those things if you haven’t taken care of the basics first. Every CCDC event is different (that’s one of the great things about the program) so while there’s no magic set of procedures and processes that will win you any CCDC event, there some tried and true security basics that will dramatically increase your chances of winning any CCDC event your team walks into.
- Change passwords. On everything. Seriously. If it has an account and a login, you will probably want to change the password. After years of running CCDC events, we still see teams going into the second or third day of an event with a default password on a router or an admin password that hasn’t been changed. A weak or default password is like a giant blinking bull’s eye to a Red Team. So when you take over a network, make changing passwords one of your first priorities.
- Secure the perimeter. If your network is an open door, the Red Team will walk right into it. Use network firewalls to block incoming connections and limit the services that can be reached from outside your network to the bare minimum. There’s no reason TCP port 135 should be open the entire world so lock it down. Don’t have a network firewall? Then each host just became its own little island with its own perimeter. Use host-based firewalls to do the same thing – limit access to services wherever you can. It’s not a bad idea to limit access at both the network and the host level either. You’re not being paranoid in this case – there really ARE people out to get you (well your systems anyway).
- Remove/restrict unnecessary services. If your server does not need a TFTP service running then turn it off. Take note of what is required and then turn off any service you don’t absolutely need to address the competition scenarios. Every service you can turn off or get rid of is one less service to worry about securing and one less target for the Red Team.
- Be prepared for contingencies. Systems get wiped out at CCDC events. Systems get taken away due to “hardware failures” or “natural disasters”. So be prepared to restore content quickly if needed. Make your own copies of critical content where you can – just make sure you store them in a secure manner.
- Read injects carefully. Most injects will tell you what the judges expect to see in your answer. If they suggest or specify a format, make sure you use it. If the inject says list the patches applied to each system, be sure to list every system in your report. Format and content are important as well so don’t ignore them, but if your inject response does not address the questions being asked of you then you will lose points no matter how pretty or well written your response is.
This is by no means a complete list – and it’s not meant to be. It’s just a reminder that when the buzzer sounds and the keys start clicking, don’t forget to take care of the basics.
