Team Lakeland vs Birdbox Enemy: Review of Regionals
I wish I could say a cool enemy like MHA Eraser Head or The Akutski but we weren't looking at all. Lakeland was acting like the Birdbox protagonists. We had our blindfolds on and continued about our day. "Birdbox Enemy" is more of a reflection on us then the hackers.
The Plan: If the hackers got the Router, Switch, or Firewall we were done for. I saved those three devices first while abandoning everything else. Adam changed the default passwords on the end devices and that was it. We were a Services and Injects team only. We had no time for incident reports. No time for IoT. No time to secure anything good enough. No time to monitor the hackers. I did customer calls. We passed around the audit packet like a hot potato. We were killing it on Services. We were doing great on Injects too. Its all that Extra stuff that got to us. We weren't over-capacitated in the realm we created but in everything we abandoned.
The whole idea about throwing the end-devices overboard is that I could morph into a lifeguard and save the service once the hackers got to it. I didn't think they would ruin anything beyond repair on Day 1. This plan worked although we got low Red Team scores.
At the end of the day we got 5th Place. We frog hopped some teams that beat us before. My battleplan was successful; I guess? I don't see another plan where Lakeland could grap 1st Place with 2 people. I made up the Birdbox Enemy 20 minutes ago. As I think about it, its the exact opposite of what a team should be doing. Its comical thinking about it. But hey don't laugh we had to pick and choose! We couldn't do it all like at Qualifiers. Services and Injects are the most points percentage wise.
The thing that confused me was how the Router and Switch remained untouched during the entire event. I kept my guard up on those devices and didn't see hacker activity. Does that mean I defended both? Were the hackers thinking "lets not touch these devices because the students don't know how to fix them"? I was hoping to play some Troubleshooter Pro. I thought the hackers were gonna go after the Virtual Routers, NAT, interfaces, VLANs, whatever. I was gonna go on a goose-hunt journey to find the problem. Was what I did enough or were the hackers instructed not to touch those devices?
Adam and I were playing Dance Dance Revolution on the Injects. The injects were released even and odd to our strengths. We danced without hitting each other and remaining in our own spaces. It reminds me of my Software partners at work. They work on one part and I work on another part somewhere else.
After Regionals was over I returned to my hotel room. I threw up and simultaneously got a nosebleed like the metal ccdc player I am. I felt terrible and it fit the atmosphere for the night. I was just really upset and dizzy. When I got home I lost 4 pounds. I'm now at my High School weight. We didn't win anything but I won my HS weight back? lol I don't know how to end this paragraph on such a depressing finish. I need a pep talk.
Pep talk inbound!!!!!
ReplyDeleteFirst off, let's address this statement:
"I threw up and simultaneously got a nosebleed like the metal ccdc player I am. I felt terrible and it fit the atmosphere for the night. I was just really upset and dizzy. When I got home I lost 4 pounds."
Please please please, do not be this stressed out about a CCDC event anymore. Not winning the regional will not ruin your life. I never won a regional event. Lots of really capable and intelligent people never won a regional event. And personally, I'd rather be able to spend 20-30 years working in the industry with another capable person at my side (theoretically speaking) to stop the ACTUAL bad guys rather than have you end up dead because of some college competition.
Ok, so now or the actual competition clarification:
"The whole idea about throwing the end-devices overboard is that I could morph into a lifeguard and save the service once the hackers got to it. I didn't think they would ruin anything beyond repair on Day 1. This plan worked although we got low Red Team scores. ... As I think about it, its the exact opposite of what a team should be doing."
This is actually the exact RIGHT game plan for securing the network. Most teams DON'T do this, and that's one of the reasons you do so well even without a full team. The low red team score has more to do with not having enough people to execute the next part in this strategy. You have to clean the endpoints that you previously abandoned to secure your perimeter. If you abandon the IOT devices, I can just pivot through them to get access to the firewall (for example).
"The thing that confused me was how the Router and Switch remained untouched during the entire event."
The red team didn't have anyone attacking the switch or router this year. The people that normally do that weren't in the room and we didn't notice until much later than we needed to.
PEP TALK:
You guys did amazing! All the professionals at the event were impressed by your team of two people. The difference between 1st place and 4th place was not a lot of points. There was a reasonable point drop off to get to 5th place. However for your team of two people, that drop off was caused by not having enough people to do all the additional work. In my personal opinion, if there had been 6 more people on your team, you would have crushed everyone and be prepping for Nationals. Good luck next year! I'm sure you'll do amazing!