Risk

11/9/2018
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Inside CSAW, a Massive Student-Led Cybersecurity Competition

Nearly 400 high school, undergraduate, and graduate students advance to the final round of New York University's CSAW games.

CSAW – Brooklyn, New York – New York University's CSAW, which calls itself the world's largest student-run cybersecurity competition, this week announced the 397 high school, undergraduate, and graduate students from around the world who will enter its final round.

CSAW started in, and is organized by, NYU's Tandon School of Engineering. This year, its 15th running, saw 3,500 teams from more than 100 countries enter the games. The remaining contenders will now travel to academic sites across four continents to compete in the finals.

The competition was founded in 2003 as a small local event by Nasir Memon, an NYU professor of computer science and engineering. It has since expanded to include eight global events, all of which evolve to host challenges and contests that align with the changing threat landscape.

"It started accidentally, like many things start," said Memon in an interview with Dark Reading at the North American branch of the CSAW finals. The event is taking place this week on NYU Tandon's campus in Brooklyn, New York.

CSAW's first participants, all Tandon students, were challenged with cleaning up poorly configured laptops among other adversarial tasks designed to test their offensive and defensive security skills. The internal competition quickly expanded — first to local New York universities, then throughout the tri-state area, and now in Mexico, Israel, and around the world.

"What we really caught on to was, there's a kind of talent that likes these adversarial challenges," Memon explained. "You cannot really teach security by lecturing in a classroom. You have to understand how attackers work."

The first stage of CSAW happens online. When competitors reach the finals, they're brought together so they can get to know each other. "In order to protect … you need to be sharing information with each other," he said. "Otherwise, the bad guys have an advantage."

Challenges are designed with the help of New York City's top white-hat hackers. Players of all ages and levels can join Capture the Flag, the flagship CSAW event that tests hacking and defensive skills. An embedded security challenge, which CSAW calls its most difficult event, pits red teams against blue teams in simulated cyberattacks. This year's, created with the United States Office of Naval Research, requires participants to perform data exfiltration attacks against Internet of Things devices.

Different challenges attract students of different levels and expertise. A Policy Challenge attracts students in policy and law school who are interested in how security will play a role. Applied Research accepts peer-reviewed security papers that have been published in scholarly journals. A forensics analysis competition is restricted to high school students, he explained.

Memon said CSAW has proven an effective way to attract students to cybersecurity, a concept he said wasn't yet in people's minds when the competition started 15 years ago. Studies show after competing, students often decide to pursue cybersecurity careers, he pointed out. If they don't, they have greater security awareness as software engineers or other non-infosec roles.

The event has become a hot spot for recruiters, who CSAW initially brought in to help offset the cost of transportation and accommodations for students who fly in for the finals. "We're not doing this to make money," Memon said, noting all the workers are volunteers. But flights and hotels for a growing pool of student competitors can get expensive.

Companies "across the board" come to CSAW to recruit security employees, he said, with the majority representing the tech and financial sectors. A growing number of businesses are expressing interest in attending the event to seek out talent.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-18913
PUBLISHED: 2019-03-21
Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a malicious DLL to the target. Once the document is opened, it may allow the attacker to take full control of the system from any location with...
CVE-2018-20031
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to preemptive item deletion in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2018-20032
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to message decoding in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor daemon t...
CVE-2018-20034
PUBLISHED: 2019-03-21
A Denial of Service vulnerability related to adding an item to a list in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier allows a remote attacker to send a combination of messages to lmgrd or the vendor daemon, causing the heartbeat between lmgrd and the vendor ...
CVE-2019-3855
PUBLISHED: 2019-03-21
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.