⚡ CyberForce Webinar: Competition 101 ⚡

This webinar is available at this YouTube link

• As we know, this competition is focused on energy-based infrastructures and networks.

• Types of teams in this competition
  • Blue team (us)
  • Red team (attackers that will try to pwn us on Nov 4th and 5th; industry professionals)
  • White team (administrators, build out infrastructure for us)
  • Gren team (users of our systems; these people test out usability, availability of our network in real time)
  • Orange team (C-suite / senior executives)
• Generally speaking, as the blue team, we communicate with all teams throughout the competition.
  • But mostly, we aim to communicate with the green team (our network users) and the orange team (our execs)
• This year, our competition scenario involves the solar energy industry.
  • In 2021, it was hydropower. 2020 was wind, 2018 was natural gas…

SCORING BREAKDOWN

Five main scoring categories:

1: Red team

• Exploitability of vulnerabilities (they ask you about a vulnerability you found, how you found it, and what you would do to fix it – be prepared to answer questions)

• Vulnerabilities introduced in buildouts (during live attack)

• Sportsmanship

2: Blue team

• Service uptime (e.g. DNS, SMTP…) – these services are required to be on certain IPs

3: Green team

• Usability
  • they mentioned a website is part of it, and they mentioned that it will be broken (e.g. misspelling, broken links, incorrect information present)

4: White team

• Security documentation (pre-competition, AKA during our network access phase)
  • they provide templates for our documentations, not sure if we should use them or just use the UF 2019 report as a template
• Information sharing/incident reporting
  • Throughout the day, they may ask us to provide some sort of information or reports of incidents.
• C-suite panel brief (pre-competition)
  • this panel brief will involve our team recording a video for these managers. communication and explanation skills are important.
  • we will want to emphasize severity of breach, potentially even ask for resources/money…

5: Anomaly scores

• Real-world challenges/tasks
  • these could be CTF-type challenges such as forensics, crypto, etc. or even a new vuln introduced in our systems.
  • in general, these challenges are meant to pull attention away from the traditional role of protecting systems.

USABILITY

• Our goal is to balance the usability of our systems for customers, employees, and ourselves WHILE maintaining security of the system.
  • BAD EXAMPLE: Implementing 10 passwords in a row within 30 seconds.
  • GOOD EXAMPLE: Implementing dual authentication (2 different password mechanism)

DOCUMENTATION

• The goal here is for us to be holistic blue teamers
  • This means we document what we are doing
• Part of understanding what we are building and defending is ensuring that others can quickly pick up where we left off
  • This way, we keep track of our hard work and others can benefit from it in the future.
• As mentioned before, this documentation needs to be written and submitted during the pre-competition phase (Oct 17th ~ November 3rd or so)

Q&A section

• The start of this Q&A video on their youtube channel (different from the competition 101 video) starts off with about 20 mins of in-person information; not relevant for us.

• What tools can we use?
  • Supposedly ONLY FREE AND/or(?) OPEN SOURCE programs?
  • We need to clarify this before the competition.
• Past Competition stuff
  • https://cyberforce.energy.gov/cyberforce-competition/prior-competitions/doe-cyberforce-competition-2019/
  • Unfortunately, no past reports are publicized here. Need to look around Google.