“Bigly Winning in Cyber”

In a very real sense I saw the difficulty of establishing a level playing field in a cyber competition; especially one that had so many challenges and aspects to it such as the 2018 Cyber Titan National Championships. Following the trail of breadcrumbs of post exploitation of a small business the approaches and investigative techniques varied considerably from team to team. A diversity of target images with at least a 50% focus on Linux and Centos (IoT) and the other Windows, including an operating system that was in production before many of the high-school students were born, added to the difficulty. “I would get Anti-Virus onto that Windows 2000 box by using a USB stick! Was met with “The OS does not support USB” stunned silence. What I saw amazed me at all levels, the students figured it out – almost each and every time.

“Improvise, Adapt and Overcome”

This was the mantra of the competing teams. Myself, Joe Landers & Pete Herzog thought of every possible and realistic method of establishing a “bad guy” hold on the network; while the students pushed them off the compromised machines. Critical to student success was documenting evidence of criminality due to a ticketing system invented by Angela Plater. This added the very real dimension of documenting the full spectrum of activities the students were undertaking and I think impressed our VIP guest from the RCMP. These teams worked really hard – remotely. That’s right. The students did not have physical access to the machines; the entire security remediation and evidence gathering work was conducted remotely over command line, Remote Desktop or VNC on the images. While that remote access challenge was unique, so was the taunting by the cyber-criminal gang responsible for the attack over social media. That added a certain level of atmosphere to the competition which seemed to encourage a “we are going to get those bad guys.” Attitude.

“Was it a competition or a workshop?” That’s a good question and one that I need to ponder in the months ahead before we start work on 2019’s competition. Of course, finishing first second and third in the DFIR or Vulnerability Management aspects of the competition is great for bragging rights – finishing top three out of the best ten Canada has to offer is no small accomplishment. Seeing the students working so hard at these challenges, two things really struck me. Firstly, with over 750+ tickets created by the students I was able to assess the outcome: All of the teams had the skill-set’s necessary to bring the business back from the dead, given enough time and access to vendor support. But, more importantly, I saw something that sends shivers down my spine – these Canadian students were good at this – I mean really good. This gave me hope for the future, something that the Information Security industry is in short supply of.

Ultimately, cyber prosperity or cyber poverty for Canadian business comes down to folks being able to protect, detect and react to fast passed security events. Based upon the supreme efforts I saw from nine high-schools and one middle-school team Canada – as always – is quietly building world class capability – starting fifty-one students at a time.

Good luck in your future careers as cyber security professionals!

-Ian

PS: Arrested members of the RPK Cyber Crime Inc. syndicate posted bail in Saskatchewan and are believed to have fled the country. Rumors they are headed to Australia are – for the moment – unfounded. There is a Canada-wide warrant for their arrest and Interpol has been notified.