Slashdot Mirror
The Student vs Hacker Security Showdown Rematch
monkeyboy44 writes "Following up on last year's entertaining hacker vs. student showdown, InformIT.com once again covered the annual Mid-Atlantic Regional Collegiate Cyber Defense Competition where college students are put to the test. During the three day event, small teams from eight of the areas colleges are handed insecure networks that they have to lockdown and keep running — all while a team of hackers attempt to gain access any way they can. To keep it interesting, the teams also had to perform various tasks, such as program web applications, install IDS systems and more — and if hacked, the US Secret Service was on hand to determine if there was enough data to start an investigation. Once again, the hackers dominated — but not without a few surprises."
The problem with this is that they gave the teams securing the network 3 hours to prep.
As someone who had to take over company's network, exactly what this exercise is meant to simulate, I can say it does take more than 3 hours to secure the services and appliances they were given without taking things offline. What's more, you usually don't have four seasoned hackers banging on your network's doorstep in your first three hours of employment. Also consider that most businesses don't keep a 10k record CC# database on a machine behind an unsecured perimeter appliance with a bunch of hokey other services running on them, accessible from outside the lan. The expectations of the whole process are a bit ridiculous to begin with, but if you gave them a day or so to secure their network and services, I'm sure they'd have done much better.
Judging by the brief accounts of each teams actions, I'd guess that in more realistic scenarios they would make reasonably effective admins.
If you put your servers physically in the hands of an attacker, there is nothing you can do to stop them quite by definition.
Of course there is. You can encrypt drives, encrypt information, use secure Mobos, etc.
As responsible for the integrity of your network, you're also responsible to let people know the level of physical security your network requires. As the article mentions, the servers were password-protected and expected to be secure. With physical access, the hackers got a suprisingly high level of penetration into the system without actually breaking it.
It seems that the only way to win this competition on the defensive would have been to re-install the latest fedora core on all four machines, and setup services that you trust instead of MS services, then hunker down and physically guard the boxes.
There was no way to "win" on the offensive. The offense wasn't being tested. The test was to see, basically, which group of sysadmins could outsurvive the rest. It wasn't an unfair competition between hackers and defenders. It was a task guaranteed to take out boxes, to see which team could best slow down the inevitable onslaught.
In a production environment you don't necessarily get to set the policy on what servers you are running, and off of what boxes. You inherit a messed up pile of old systems, legacy software that nobody can update anymore, buggy drivers, and Windows users installing trojans and giving their passwords away to the first person who comes along with a YourCompanySecurity username on AIM. The fact that they took the end users out of the equation was a huge blessing to the sysadmins.
Notice that they made damned sure that none of these computers were attached to the internet at the time of the task. These weren't the best of the best hackers the competition could find. These were a small pool of good hackers vs a small pool of sysadmins. If they had actually put these things on the internet, like production environments face every day, they would not have survived.
Hence, the pre-installed keyloggers.
The ______ Agenda
It wasn't to inspire awe in the hackers, many people don't seem to realize this. The whole point of the excercise, indeed, it appears, was to give the hackers the advantage, and see how the admins coped.
Further, the point of the whole thing was to expose people who might one day face challenges such as those posed by the hacker teams some real world experience, and understanding of how much vigilance it really does take to secure a given system.
In other words, it was sort of DESIGNED as a scare-tactic to the admins. In the long term some of them may indeed become overly security-paranoid, but in fact the point of the challenge was to cause a greater level of anxiety, hopefully to insure that companies who chose to hire individuals from the admin team would be better protected from loss, and that those individuals would hopefully enjoy imporved job security.
The whole thing was setup to attempt to reverse the standard, day-to-day lackluster security practices employed by the majority of the IT industry.
-taosk8r
Just to point out two things you said:
Of course there is. You can encrypt drives, encrypt information, use secure Mobos, etc.
In a production environment you don't necessarily get to set the policy on what servers you are running, and off of what boxes.
Those two assumptions are somewhat conflicting I would say.
On the first point
The performance tradeoff for encrypted filesystems is seldom worth it on servers when you can physically secure them fairly trivially. If your building is regularly invaded, you have bigger problems. In any case, even if you can stop data loss with disk encryption, the guy could just take a hammer to your server and cause a DoS at the very least, and there is nothing you can do if you allow him physical access.
On the second point: if you are such a low level peon in the a company that you are forced to accept bug ridden systems, then security is a forgone conclusion. Heck- acheiving it might compromise job security. I might suggest looking for a better job. Instead, if you are in a position to offer "services" to the company, such as email, DNS, or NAS then YOU (The IT dept) get to decide how to provide them, and then you can make decisions with security in mind. Before we get too separated from reality, we have to remember that the point of computers is to offer data services to the users, not to offer brand names. The rest of the company shouldnt even have to know whats behind the curtain, just that everything is up and running smoothly.
Being asked to secure pre-owned windows servers is like being asked to levitate. Just give it up and re-install something else. The entirety of the O/S is analogous to trojan horse malware to start with, being that you do not get the source code. Trying to hold back the tide with a spoon and a colander is not my idea of security.
It was a task guaranteed to take out boxes, to see which team could best slow down the inevitable onslaught.
That would be uninteresting. Why even try.
I think it should be not only possible, but fairly easy to setup a network that would provide service and not be penetratable over the network. You could even go for extra points by detecting unwanted probing or intrusions and blackholing the attacker's traffic so that you don't even suffer from a degradation of service. But assuming you will
lose is the wrong mindset, imo. You have to play to win.