Hackfest - Level UP

The numbers of software vulnerabilities and misconfigurations keep growing year over year. Addressing them requires concerted efforts of "builders": software developers, QA, IT specialists. Unfortunately, too often the task of securing software falls to "breakers", such as pentesters and security researchers, who expose problems and push for improvements.

Widespread software weaknesses can be partially explained by the engineers' insufficient knowledge of secure software development. One of the most effective ways to improve it is to "gamify" the learning process. This will add rewards, healthy competition and stimulate the acquisition of practical skills.

Unfortunately "gamified" training is almost exclusively available to those on the "offensive" side. Security competitions, challenge sites, and hands-on security certifications all provide excellent opportunities for building practical attack security skills. There is a shortage of such opportunities for professionals on the "defensive" side.

In this talk, we will discuss this imbalance in greater depth and propose ways of making acquiring practical defensive security skills more effective.

We will also describe an open-source defence competition framework that we are releasing and share our experiences running defence-style competitions.