Security Competition!

My understanding is that you'll be attacked from outside your switch, so I'd mirror the uplink port and put snort on that. Or you can put it inline and have it actively block for you - but that could take a while to learn to do right. The biggest thing about snort is tuning the rules, so you'll want to have these ready to go before you arrive.

If you need for the other machines to access the internet, install squid on the windows box.

Focus on strategy and teamwork. Make sure each person knows their role, and keep your calm. Turn off unused services - they'll definetly be scanning for oddball ways to get in with some vuln (using metasploit possibly). Setup firewalls if you can. Think about the weaknesses, both from the outside and the inside. DO NOT TRUST YOUR NETWORK! Hard on the outside, chewy in the middle, right? Think about situations like if one of your boxes is compromised - what are you going to do to restore services? Have any backups?

It will be lots of fun, and you'll definetly learn a ton. Just try to account for all that you can, and expect that the first problem you'll deal with will be something you never expected!
 
you could consider setting up some honeypot devices to keep the attackers busy instead of damaging your real network :D
 
how much time do you have to prepare before the red team starts attacking?
 
Use GP to its fullest.

Setup port mirroring for Snort and Wireshark so you see all traffic.

Are the only services going to be Apache, Exchange services, AD login, and MySQL?
 
Wow this is already coming up? I was thinking about participating but my schools application deadline for the team was the same night I learned about it. -_-

Actually I just checked, my region already finished on March 1.
 
the only reason i thought of that was a security class i had in college.. we had a similar competition to attack/defend our networks. that honeyd program was very useful!
 
A local college here just returned from competion - and apparently, every host they had to protect had a problem that they had to fix as soon as they started.

In this instance, they tried running windows updates on the XP host - but it was blocked by the proxy. They figured out the patches were on one of the servers, but by that time the XP box was compromised (10 minutes).

In this case my advice would be to throw up defenses, fix what is broken, and then continue your normal plan.
 
Honeypots are worthless in this because the whole point is the attacker not knowing what's there and seeing something fake. It's different when the attackers are in the same room and know what equipment/os you have.
 
bigdogchris said:
Honeypots are worthless in this because the whole point is the attacker not knowing what's there and seeing something fake. It's different when the attackers are in the same room and know what equipment/os you have.
Click to expand...

actually, isn't that the point of the honeypot? they dont' know it's fake since they don't know the network, so they will be trying to hack something that isn't worth hacking. essentially they will be wasting precious time, giving you more time to set up your defense and fixes.
 
berky said:
actually, isn't that the point of the honeypot? they don't' know it's fake since they don't know the network, so they will be trying to hack something that isn't worth hacking. essentially they will be wasting precious time, giving you more time to set up your defense and fixes.
Click to expand...

+1

They don't know your setup, so a quick honeypot deployment could actually be really useful if they fall for it.
 
breadtk said:
-Windows Xp Pro - Only computer that can connect to the Internet for patches and what not


The main restrictions of the competitions are:
-You can only use that one Windows Xp box to connect to the Internet.
Click to expand...

The very first thing I would do is unplug the internet connection from this box and image it's drive. I would consider this box one of their main targets.

I would also get to know the routes to your patches. Check those routes before downloading anything.

Good luck and have fun
 
heh, CCDC..

If you haven't read the CCSP books cover to cover you're going to get owned pretty quickly. Unless they changed it, you're going to have a router, switch and a firewall(ASA), so know your Cisco security.

Honey pots are a waste of time, they have proved to allow the red-team more time to pop the rest of your network while you're getting everything in order(this is what ive been told many times). Work on fixing the vuln. you know about. Also, have access to full disclosure sites within your grasp at all times. Have a list of all recent/"BIG" security holes that have been found within the past 5 years. You will get your network in shambles, bascially it goes like this "some IT team has hosed up this customers network, fix it".

IDS/IPS's are you friend, people have mentioned snort... excellent suggestion. Run it inline so you can have more IPS functionality. SPAN is an option if you dont want to do that.

Spacehonkey is right, they will be attacking you from the outside.. but there is a service "counting" server where it measures uptimes(this is how the score is kept). You need to have the most highly available network, so you can't just turn off something(someone recommended this, :rolleyes: idiot). You will get requests from your "customer" to "allow" particular services mid way into the competition so that the red-team can work on poping them.

The red-team is no joke, they are seasoned security professionals(when nationals roles around). They will not only work on accessing your network, watch out for social engineering... keyboard surfing(yes, they are allow where you sit IF you let them in!), anything.... they might try and get your drunk after the first day and weasel some information out of you.... this HAS happened before. Dont get it twisted.

My old roommates team took nationals a few years ago, and was asked to join the red-team but because of work obligations he couldn't. I have never participated in these competitions but they are very easy if you stay calm, stick with your team and have a CLEAR and DEFINED leader. If you don't, you're going to get owned.

BTW, if you get to nationals(or are in, haven't followed this stuff at all. hah) the skill level of these security guys are like this... they write 0 days during the competition.
 
xphil3 said:
heh, CCDC..

If you haven't read the CCSP books cover to cover you're going to get owned pretty quickly. Unless they changed it, you're going to have a router, switch and a firewall(ASA), so know your Cisco security.

Honey pots are a waste of time, they have proved to allow the red-team more time to pop the rest of your network while you're getting everything in order(this is what ive been told many times). Work on fixing the vuln. you know about. Also, have access to full disclosure sites within your grasp at all times. Have a list of all recent/"BIG" security holes that have been found within the past 5 years. You will get your network in shambles, bascially it goes like this "some IT team has hosed up this customers network, fix it".

IDS/IPS's are you friend, people have mentioned snort... excellent suggestion. Run it inline so you can have more IPS functionality. SPAN is an option if you dont want to do that.

Spacehonkey is right, they will be attacking you from the outside.. but there is a service "counting" server where it measures uptimes(this is how the score is kept). You need to have the most highly available network, so you can't just turn off something(someone recommended this, :rolleyes: idiot). You will get requests from your "customer" to "allow" particular services mid way into the competition so that the red-team can work on poping them.

The red-team is no joke, they are seasoned security professionals(when nationals roles around). They will not only work on accessing your network, watch out for social engineering... keyboard surfing(yes, they are allow where you sit IF you let them in!), anything.... they might try and get your drunk after the first day and weasel some information out of you.... this HAS happened before. Dont get it twisted.

My old roommates team took nationals a few years ago, and was asked to join the red-team but because of work obligations he couldn't. I have never participated in these competitions but they are very easy if you stay calm, stick with your team and have a CLEAR and DEFINED leader. If you don't, you're going to get owned.

BTW, if you get to nationals(or are in, haven't followed this stuff at all. hah) the skill level of these security guys are like this... they write 0 days during the competition.
Click to expand...


I only wish I was that good. oh well, I'll just keep dreaming...
 
You must log in or register to reply here.
Back
Top