26/02/2017

Competitive Securiwhat?

Competitive Security - apparently that's a thing. Otherwise known as Capture the Flag (CTF), these events pit teams against each other in an attempt to compromise systems and solve challenges. After taking part in a few, here are some observations I've made.

1) Being comfortable with Linux is half the battle

The problems that you have to solve during a CTF will be hard, and the last thing you want interrupting your thought process is five minutes of fumbling while you try and remember how to compile something with GCC. This is something that comes with practice, so make sure you spend some time after each event going over the things that you were embarrassed you couldn't do! Using Linux on a daily or semi-regular basis is the best way to proactively build up these skills outside of competitions; you'll find that over time the number of non-standard tasks you need to do builds up until eventually you'll be navigating the command line with more confidence.

2) Competitions are not the place to learn new skills

They're great places to highlight the things you need to work on, and you will pick up tips and tricks, but it's unreasonable to expect to come away from an event knowing how to use a tool or technique that you didn't know when you arrived that morning. One way to mitigate this is to corner people you want to learn from during breaks or after the close of play. This way you can still make use of them as teachers without it getting in the way of what you're there for - the competition. As above, make a note of what you struggled with so you can get some practice before the next event, and don't start googling C++ hello world tutorials or asking the network guru about WiFi frequency bands when there are puzzles to solve.

3) The 10X factor

Excusing the slightly cheesy name given to it by a company I interned for, this refers to the idea that it's normally better to sacrifice some of your own productivity in order to keep your team working at full efficiency. Everyone in the team should be roughly aware of what each member is working on - if people are starting to drift, call a huddle or go around and get everyone up to speed. If you don't you'll just end up wasting effort when you forget to tell the network specialist that you also connected to the VPN and they end up spending half an hour defending your operation from this new adversary who's running Kali. Doubling up and working in pairs can help to reduce typos and silly gotchas, but more than two people round a keyboard can end up with the situation where everyone thinks someone else is paying attention. 

I feel like there should be something here about having fun, but that's probably unnecessary...