CapturetheFlagGames.pptVIP

Capture the Flag Games Measuring Skill with Hacking Contests By Riley “Caezar” Eller Security Training Problems Computer security problems are here to stay Hackers know more than administrators Consultants are hard to measure Administrators need to minimize the delay between discovering a vulnerability and patching the problem Solution: Security Games “Capture the Flag” or “CTF” games Spread security techniques Measure security skill Strengthen technical and management skills CTF is difficult because Security is arduous work Player skill varies greatly Scoring is often imbalanced or indeterminate Spreading Security Techniques Accelerating the learning curve of our administrators is critical Convincing hackers to demonstrate their tricks in public is an exceptionally good way to do this Security professionals can take what they learn back to work Measuring Security Skill It is difficult to measure the value of security consultants and employees “Capture the Flag” games have matured in the 21st century With a well-considered scoring system, these games can be used to accurately measure player skill Learning From Performance Careful event logging allows us to measure Effectiveness Responsiveness Team Coordination Learn more from competition than testing Capture the Flag Originally a children’s game to simulate small team combat, based on defending an immobile flag while trying to capture the flag of the other team Now, generally any game where teams defend and attack symmetrical targets simultaneously DEFCON Game History Early years Initially there were free terminals provided for conference attendees, who immediately tried to print text on the screens of other users DEFCON Game History DEFCON 4 Formalized game with several servers provided as hacking targets Judges were used to decide when a machine had been hacked and then awarded a point DEFCON Game History DEFCON 5 and 6 Invited participants either to provide a server to be attacked, or to attack the provided serve