Ten years of iCTF: The good, the bad, and the ugly

Giovanni Vigna; Kevin Borgolte; Jacopo Corbetta; Adam Doupe; Yanick Fratantonio; Luca Invernizzi; Dhilung Kirat; Yan Shoshitaishvili

Ten years of iCTF: The good, the bad, and the ugly

Giovanni Vigna, Kevin Borgolte, Jacopo Corbetta, Adam Doupe, Yanick Fratantonio, Luca Invernizzi, Dhilung Kirat, Yan Shoshitaishvili

Research output: Contribution to conference › Paper › peer-review

58 Scopus citations

Abstract

Security competitions have become a popular way to foster security education by creating a competitive environment in which participants go beyond the effort usually required in traditional security courses. Live security competitions (also called “Capture The Flag,” or CTF competitions) are particularly well-suited to support hands-on experience, as they usually have both an attack and a defense component. Unfortunately, because these competitions put several (possibly many) teams against one another, they are difficult to design, implement, and run. This paper presents a framework that is based on the lessons learned in running, for more than 10 years, the largest educational CTF in the world, called iCTF. The framework's goal is to provide educational institutions and other organizations with the ability to run customizable CTF competitions. The framework is open and leverages the security community for the creation of a corpus of educational security challenges.

Original language	English (US)
State	Published - 2014
Externally published	Yes
Event	2014 USENIX Summit on Gaming, Games, and Gamification in Security Education, 3GSE 2014 - San Diego, United States Duration: Aug 18 2014 → …

Conference

Conference	2014 USENIX Summit on Gaming, Games, and Gamification in Security Education, 3GSE 2014
Country/Territory	United States
City	San Diego
Period	8/18/14 → …

ASJC Scopus subject areas

Computer Networks and Communications
Information Systems
Control and Systems Engineering
Safety, Risk, Reliability and Quality
Education

Cite this

@conference{4ee65229cc144a25b9169d3a066f7eb8,

title = "Ten years of iCTF: The good, the bad, and the ugly",

abstract = "Security competitions have become a popular way to foster security education by creating a competitive environment in which participants go beyond the effort usually required in traditional security courses. Live security competitions (also called “Capture The Flag,” or CTF competitions) are particularly well-suited to support hands-on experience, as they usually have both an attack and a defense component. Unfortunately, because these competitions put several (possibly many) teams against one another, they are difficult to design, implement, and run. This paper presents a framework that is based on the lessons learned in running, for more than 10 years, the largest educational CTF in the world, called iCTF. The framework's goal is to provide educational institutions and other organizations with the ability to run customizable CTF competitions. The framework is open and leverages the security community for the creation of a corpus of educational security challenges.",

author = "Giovanni Vigna and Kevin Borgolte and Jacopo Corbetta and Adam Doupe and Yanick Fratantonio and Luca Invernizzi and Dhilung Kirat and Yan Shoshitaishvili",

note = "Funding Information: This work was supported by the National Science Foundation, through grants CNS-0820907, CNS-0716753, and CNS-0939188, and by the ARO through MURI grant W911NF-09-1-0553. We want to especially thank Carl Landwehr, Jeremy Epstein, and Karl Levitt at the National Science Foundation for their support to cyber-competitions. Publisher Copyright: {\textcopyright} 2014 USENIX Summit on Gaming, Games, and Gamification in Security Education, 3GSE 2014. All rights reserved.; 2014 USENIX Summit on Gaming, Games, and Gamification in Security Education, 3GSE 2014 ; Conference date: 18-08-2014",

year = "2014",

language = "English (US)",

}

TY - CONF

T1 - Ten years of iCTF

T2 - 2014 USENIX Summit on Gaming, Games, and Gamification in Security Education, 3GSE 2014

AU - Vigna, Giovanni

AU - Borgolte, Kevin

AU - Corbetta, Jacopo

AU - Doupe, Adam

AU - Fratantonio, Yanick

AU - Invernizzi, Luca

AU - Kirat, Dhilung

AU - Shoshitaishvili, Yan

N1 - Funding Information: This work was supported by the National Science Foundation, through grants CNS-0820907, CNS-0716753, and CNS-0939188, and by the ARO through MURI grant W911NF-09-1-0553. We want to especially thank Carl Landwehr, Jeremy Epstein, and Karl Levitt at the National Science Foundation for their support to cyber-competitions. Publisher Copyright: © 2014 USENIX Summit on Gaming, Games, and Gamification in Security Education, 3GSE 2014. All rights reserved.

PY - 2014

Y1 - 2014

N2 - Security competitions have become a popular way to foster security education by creating a competitive environment in which participants go beyond the effort usually required in traditional security courses. Live security competitions (also called “Capture The Flag,” or CTF competitions) are particularly well-suited to support hands-on experience, as they usually have both an attack and a defense component. Unfortunately, because these competitions put several (possibly many) teams against one another, they are difficult to design, implement, and run. This paper presents a framework that is based on the lessons learned in running, for more than 10 years, the largest educational CTF in the world, called iCTF. The framework's goal is to provide educational institutions and other organizations with the ability to run customizable CTF competitions. The framework is open and leverages the security community for the creation of a corpus of educational security challenges.

AB - Security competitions have become a popular way to foster security education by creating a competitive environment in which participants go beyond the effort usually required in traditional security courses. Live security competitions (also called “Capture The Flag,” or CTF competitions) are particularly well-suited to support hands-on experience, as they usually have both an attack and a defense component. Unfortunately, because these competitions put several (possibly many) teams against one another, they are difficult to design, implement, and run. This paper presents a framework that is based on the lessons learned in running, for more than 10 years, the largest educational CTF in the world, called iCTF. The framework's goal is to provide educational institutions and other organizations with the ability to run customizable CTF competitions. The framework is open and leverages the security community for the creation of a corpus of educational security challenges.

UR - http://www.scopus.com/inward/record.url?scp=85073186259&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85073186259&partnerID=8YFLogxK

M3 - Paper

AN - SCOPUS:85073186259

Y2 - 18 August 2014

ER -

Ten years of iCTF: The good, the bad, and the ugly

Abstract

Conference

ASJC Scopus subject areas

Other files and links

Fingerprint

Cite this