SlideShare ist ein Scribd-Unternehmen logo
1 von 31
Tom Kopchak
Competitive Cyber Security:
The Ultimate Training
Experience
•Who Am I?
•Why Am I here, and what
got me here?
•Why I am passionate about
computer security?
About the Presenter -
Who am I?
How many of you have
experienced a cyber-attack?
System intrusion?
Malware Infestation?
Rushed project?
Mysterious network?
•Hopefully, most of you can relate to several of these
scenarios
•If you have not experienced anything, at least some of
you are lying, misinformed, or new
•If you aren't worried about attacks, why are you here?
Cyber-Attacks!
•Incidents will happen
•Systems will be compromised
•Applications need to both work and be secure
•People will break things
•You will need to be an expert on something
you've never seen before
Truths
Top Skills
•Fundamental
understanding of security
concepts
•Technical skills
•Direct experience
•Personal experience/on your
own
•Technology-specific training
•Formal education
How do I get skills?
•Nothing beats practical experience
•How do you get practical experience?
• Production systems
• Personal equipment
• Labs
• Simulated production systems
Practical
•Hands on, practical experience
•Simulated Production systems
•Types
• Defense
• Attack
• Attack/Defend
Competitive Security Events
Collegiate Cyber Defense
Competition (CCDC)
•National Collegiate Cyber Security Competition
•Focuses on both business and technical aspects
Collegiate Cyber Defense
Competition (CCDC)
• Pre-qualifying (state) events
• Regional events
• Growing every year
• Winner goes to national competition
• National Competition
• San Antonio, Texas
• Top 9 teams in the nation
Competition Structure
• Competing teams have just been
hired as the IT staff for a company
• Everyone was fired
• Teams must secure their network,
while completing a multitude of
business tasks (injects)
• Red team = bad guys
Competition Premise
• DNS
• Mail (SMTP and POP)
• Web
• Secure Web (ecommerce)
• FTP
• Database
• SSH
• VoIP
What types of applications?
• Cisco IOS (Router, Switch, ASA)
• Windows
• Linux
• MacOS
• Printers
• VoIP Phones
• Wireless
What types of systems?
• Investigate a database breach
• Deploy McAfee security software
• Upgrade clients to Windows 7
• Provide a list of top attacking IPs
• Install and configure Splunk
Potential Injects - Technical
• Block social networking websites
• Develop an IT policy
• Create user accounts
• Recover lost e-mail
• Create a job description for HR
Potential Injects - Business
• Unplug everything, secure it, and bring it back online
• Services are not available
• Customers are not happy
• Mitigate security issues while keeping services alive
• The red team is everywhere
• Run away, crying
Potential Strategies – Day One
• Number of issues/systems/tasks greater than
available manpower
• Unexpected difficulties/limitations/business rules
and policies
• Uptime & SLA requirements
Challenges
EMC Training Center: Franklin, MassachusettsTopology – 2011 Regionals
Topology - 2011 Nationals
San Antonio, Texas
•Storytime with Tom (time permitting)
•CCDC experiences
•Red team attacks
•Strange tasks
Personal Experiences
•CCDC = NCAA of Computer Security
•US Cyber Challenge
•Private Events
• RIT Information Technology Talent Search (ISTS)
• Hurricane Labs Hackademic Challenge
• Hack for Hunger
But wait, there's more!
•Many opportunities/needs exist
•Gain experience yourself, and help others get involved
Get involved,
and encourage others!
Wrap Up/QA

Weitere ähnliche Inhalte

Was ist angesagt?

Qualys user group presentation - vulnerability management - November 2009 v1 3
Qualys user group presentation - vulnerability management - November 2009 v1 3Qualys user group presentation - vulnerability management - November 2009 v1 3
Qualys user group presentation - vulnerability management - November 2009 v1 3
Tom King
 
Ruxmon April 2014 - Introduction to iOS Penetration Testing
Ruxmon April 2014 - Introduction to iOS Penetration TestingRuxmon April 2014 - Introduction to iOS Penetration Testing
Ruxmon April 2014 - Introduction to iOS Penetration Testing
eightbit
 

Was ist angesagt? (20)

Five Lessons Learned From Breaking Into A Casino: Confessions of a Penetratio...
Five Lessons Learned From Breaking Into A Casino: Confessions of a Penetratio...Five Lessons Learned From Breaking Into A Casino: Confessions of a Penetratio...
Five Lessons Learned From Breaking Into A Casino: Confessions of a Penetratio...
 
Secure by Design - Security Design Principles for the Working Architect
Secure by Design - Security Design Principles for the Working ArchitectSecure by Design - Security Design Principles for the Working Architect
Secure by Design - Security Design Principles for the Working Architect
 
Online Retailer's Conference 2013 - Hacking Mobile Applications - Industry Ca...
Online Retailer's Conference 2013 - Hacking Mobile Applications - Industry Ca...Online Retailer's Conference 2013 - Hacking Mobile Applications - Industry Ca...
Online Retailer's Conference 2013 - Hacking Mobile Applications - Industry Ca...
 
​Understanding the Internet of Things
​Understanding the Internet of Things​Understanding the Internet of Things
​Understanding the Internet of Things
 
How to Break Software: Embedded Edition
How to Break Software: Embedded EditionHow to Break Software: Embedded Edition
How to Break Software: Embedded Edition
 
Security Technology Arms Race - Hack in the Box 2021 keynote
Security Technology Arms Race - Hack in the Box 2021 keynoteSecurity Technology Arms Race - Hack in the Box 2021 keynote
Security Technology Arms Race - Hack in the Box 2021 keynote
 
Automation and open source turning the tide on the attackers
Automation and open source   turning the tide on the attackersAutomation and open source   turning the tide on the attackers
Automation and open source turning the tide on the attackers
 
Essential Layers of IBM i Security: System-Access Security
Essential Layers of IBM i Security: System-Access SecurityEssential Layers of IBM i Security: System-Access Security
Essential Layers of IBM i Security: System-Access Security
 
Hacker vs tools
Hacker vs toolsHacker vs tools
Hacker vs tools
 
Hacker vs Tools: Which to Choose?
Hacker vs Tools: Which to Choose?Hacker vs Tools: Which to Choose?
Hacker vs Tools: Which to Choose?
 
What's in a Jailbreak? - BSides 2019 keynote
What's in a Jailbreak? - BSides 2019 keynoteWhat's in a Jailbreak? - BSides 2019 keynote
What's in a Jailbreak? - BSides 2019 keynote
 
Owasp joy of proactive security
Owasp joy of proactive securityOwasp joy of proactive security
Owasp joy of proactive security
 
Qualys user group presentation - vulnerability management - November 2009 v1 3
Qualys user group presentation - vulnerability management - November 2009 v1 3Qualys user group presentation - vulnerability management - November 2009 v1 3
Qualys user group presentation - vulnerability management - November 2009 v1 3
 
Smart Bombs: Mobile Vulnerability and Exploitation
Smart Bombs: Mobile Vulnerability and ExploitationSmart Bombs: Mobile Vulnerability and Exploitation
Smart Bombs: Mobile Vulnerability and Exploitation
 
3 florin coada - sast in the days of dev ops
3   florin coada - sast in the days of dev ops3   florin coada - sast in the days of dev ops
3 florin coada - sast in the days of dev ops
 
It security the condensed version
It security  the condensed version It security  the condensed version
It security the condensed version
 
Blackhat USA Mobile Security Panel 2011
Blackhat USA Mobile Security Panel 2011Blackhat USA Mobile Security Panel 2011
Blackhat USA Mobile Security Panel 2011
 
The (Memory) Safety Dance - SAS 2017 keynote
The (Memory) Safety Dance - SAS 2017 keynoteThe (Memory) Safety Dance - SAS 2017 keynote
The (Memory) Safety Dance - SAS 2017 keynote
 
Ruxmon April 2014 - Introduction to iOS Penetration Testing
Ruxmon April 2014 - Introduction to iOS Penetration TestingRuxmon April 2014 - Introduction to iOS Penetration Testing
Ruxmon April 2014 - Introduction to iOS Penetration Testing
 
Bringing Government and Enterprise Security Controls to the Android Endpoint
Bringing Government and Enterprise Security Controls to the Android EndpointBringing Government and Enterprise Security Controls to the Android Endpoint
Bringing Government and Enterprise Security Controls to the Android Endpoint
 

Ähnlich wie Competitive Cyber Security

WTF is Penetration Testing
WTF is Penetration TestingWTF is Penetration Testing
WTF is Penetration Testing
NetSPI
 
Information Technology at IMS
Information Technology at IMSInformation Technology at IMS
Information Technology at IMS
Charles Stevenson
 
Internet Etiqute
Internet EtiquteInternet Etiqute
Internet Etiqute
Anay Mishra
 

Ähnlich wie Competitive Cyber Security (20)

Competitive cyber security
Competitive cyber securityCompetitive cyber security
Competitive cyber security
 
WTF is Penetration Testing
WTF is Penetration TestingWTF is Penetration Testing
WTF is Penetration Testing
 
Refugees on Rails Berlin - #2 Tech Talk on Security
Refugees on Rails Berlin - #2 Tech Talk on SecurityRefugees on Rails Berlin - #2 Tech Talk on Security
Refugees on Rails Berlin - #2 Tech Talk on Security
 
Intro to INFOSEC
Intro to INFOSECIntro to INFOSEC
Intro to INFOSEC
 
Information Security: Advanced SIEM Techniques
Information Security: Advanced SIEM TechniquesInformation Security: Advanced SIEM Techniques
Information Security: Advanced SIEM Techniques
 
Presentation infra and_datacentrre_dialogue_v2
Presentation infra and_datacentrre_dialogue_v2Presentation infra and_datacentrre_dialogue_v2
Presentation infra and_datacentrre_dialogue_v2
 
Computer Security
Computer SecurityComputer Security
Computer Security
 
Pentesting Tips: Beyond Automated Testing
Pentesting Tips: Beyond Automated TestingPentesting Tips: Beyond Automated Testing
Pentesting Tips: Beyond Automated Testing
 
WTF is Penetration Testing
WTF is Penetration TestingWTF is Penetration Testing
WTF is Penetration Testing
 
Defending Enterprise IT - beating assymetricality
Defending Enterprise IT - beating assymetricalityDefending Enterprise IT - beating assymetricality
Defending Enterprise IT - beating assymetricality
 
Information Technology at IMS
Information Technology at IMSInformation Technology at IMS
Information Technology at IMS
 
The_Pentester_Blueprint.pdf
The_Pentester_Blueprint.pdfThe_Pentester_Blueprint.pdf
The_Pentester_Blueprint.pdf
 
2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection2023 NCIT: Introduction to Intrusion Detection
2023 NCIT: Introduction to Intrusion Detection
 
Internet Etiqute
Internet EtiquteInternet Etiqute
Internet Etiqute
 
Career In Information security
Career In Information securityCareer In Information security
Career In Information security
 
How To Start Your InfoSec Career
How To Start Your InfoSec CareerHow To Start Your InfoSec Career
How To Start Your InfoSec Career
 
Why defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skillWhy defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skill
 
Inetsecurity.in Ethical Hacking presentation
Inetsecurity.in Ethical Hacking presentationInetsecurity.in Ethical Hacking presentation
Inetsecurity.in Ethical Hacking presentation
 
InfoSecurity.be 2011
InfoSecurity.be 2011InfoSecurity.be 2011
InfoSecurity.be 2011
 
Careers in Cyber Security
Careers in Cyber SecurityCareers in Cyber Security
Careers in Cyber Security
 

Mehr von Coastal Pet Products, Inc.

Mehr von Coastal Pet Products, Inc. (13)

Defense in Depth – Your Security Castle
Defense in Depth – Your Security CastleDefense in Depth – Your Security Castle
Defense in Depth – Your Security Castle
 
IT Security in 2014
IT Security in 2014IT Security in 2014
IT Security in 2014
 
Printer Security
Printer SecurityPrinter Security
Printer Security
 
Domain Name System
Domain Name SystemDomain Name System
Domain Name System
 
Using Big Data for Security Alerting
Using Big Data for Security Alerting Using Big Data for Security Alerting
Using Big Data for Security Alerting
 
SNMP & The Dark Side of the Force
SNMP & The Dark Side of the Force SNMP & The Dark Side of the Force
SNMP & The Dark Side of the Force
 
Sounds of Security
Sounds of SecuritySounds of Security
Sounds of Security
 
Beyond The Splunk App for Enterprise Security
Beyond The Splunk App for Enterprise SecurityBeyond The Splunk App for Enterprise Security
Beyond The Splunk App for Enterprise Security
 
Encryption for Everyone
Encryption for EveryoneEncryption for Everyone
Encryption for Everyone
 
Attacking and Defending Full Disk Encryption
Attacking and Defending Full Disk EncryptionAttacking and Defending Full Disk Encryption
Attacking and Defending Full Disk Encryption
 
Forensics for the Defense
Forensics for the DefenseForensics for the Defense
Forensics for the Defense
 
Big Data, Security Intelligence, (And Why I Hate This Title)
Big Data, Security Intelligence, (And Why I Hate This Title) Big Data, Security Intelligence, (And Why I Hate This Title)
Big Data, Security Intelligence, (And Why I Hate This Title)
 
Cloud Security: Ten Things
Cloud Security: Ten ThingsCloud Security: Ten Things
Cloud Security: Ten Things
 

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?What Are The Drone Anti-jamming Systems Technology?
What Are The Drone Anti-jamming Systems Technology?
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...Driving Behavioral Change for Information Management through Data-Driven Gree...
Driving Behavioral Change for Information Management through Data-Driven Gree...
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
GenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day PresentationGenCyber Cyber Security Day Presentation
GenCyber Cyber Security Day Presentation
 
Tech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdfTech Trends Report 2024 Future Today Institute.pdf
Tech Trends Report 2024 Future Today Institute.pdf
 
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
Mastering MySQL Database Architecture: Deep Dive into MySQL Shell and MySQL R...
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 

Competitive Cyber Security

  • 1. Tom Kopchak Competitive Cyber Security: The Ultimate Training Experience
  • 2. •Who Am I? •Why Am I here, and what got me here? •Why I am passionate about computer security? About the Presenter - Who am I?
  • 3. How many of you have experienced a cyber-attack?
  • 8. •Hopefully, most of you can relate to several of these scenarios •If you have not experienced anything, at least some of you are lying, misinformed, or new •If you aren't worried about attacks, why are you here? Cyber-Attacks!
  • 9. •Incidents will happen •Systems will be compromised •Applications need to both work and be secure •People will break things •You will need to be an expert on something you've never seen before Truths
  • 10. Top Skills •Fundamental understanding of security concepts •Technical skills •Direct experience
  • 11. •Personal experience/on your own •Technology-specific training •Formal education How do I get skills?
  • 12. •Nothing beats practical experience •How do you get practical experience? • Production systems • Personal equipment • Labs • Simulated production systems Practical
  • 13. •Hands on, practical experience •Simulated Production systems •Types • Defense • Attack • Attack/Defend Competitive Security Events
  • 15. •National Collegiate Cyber Security Competition •Focuses on both business and technical aspects Collegiate Cyber Defense Competition (CCDC)
  • 16. • Pre-qualifying (state) events • Regional events • Growing every year • Winner goes to national competition • National Competition • San Antonio, Texas • Top 9 teams in the nation Competition Structure
  • 17. • Competing teams have just been hired as the IT staff for a company • Everyone was fired • Teams must secure their network, while completing a multitude of business tasks (injects) • Red team = bad guys Competition Premise
  • 18. • DNS • Mail (SMTP and POP) • Web • Secure Web (ecommerce) • FTP • Database • SSH • VoIP What types of applications?
  • 19. • Cisco IOS (Router, Switch, ASA) • Windows • Linux • MacOS • Printers • VoIP Phones • Wireless What types of systems?
  • 20. • Investigate a database breach • Deploy McAfee security software • Upgrade clients to Windows 7 • Provide a list of top attacking IPs • Install and configure Splunk Potential Injects - Technical
  • 21. • Block social networking websites • Develop an IT policy • Create user accounts • Recover lost e-mail • Create a job description for HR Potential Injects - Business
  • 22. • Unplug everything, secure it, and bring it back online • Services are not available • Customers are not happy • Mitigate security issues while keeping services alive • The red team is everywhere • Run away, crying Potential Strategies – Day One
  • 23. • Number of issues/systems/tasks greater than available manpower • Unexpected difficulties/limitations/business rules and policies • Uptime & SLA requirements Challenges
  • 24. EMC Training Center: Franklin, MassachusettsTopology – 2011 Regionals
  • 25.
  • 26. Topology - 2011 Nationals San Antonio, Texas
  • 27.
  • 28. •Storytime with Tom (time permitting) •CCDC experiences •Red team attacks •Strange tasks Personal Experiences
  • 29. •CCDC = NCAA of Computer Security •US Cyber Challenge •Private Events • RIT Information Technology Talent Search (ISTS) • Hurricane Labs Hackademic Challenge • Hack for Hunger But wait, there's more!
  • 30. •Many opportunities/needs exist •Gain experience yourself, and help others get involved Get involved, and encourage others!

Hinweis der Redaktion

  1. Matrix reference - "load me up the helicopter program"
  2. Based on Career Impact Survey of more than 2250 information security professionals conducted by (ISC)², the administrators of the CISSP certification.
  3. CCN Network at HL
  4. Business/Technical
  5. Business/Technical