Language: English
The numbers of software vulnerabilities and misconfigurations keep growing year over year. Addressing them requires concerted efforts of "builders": software developers, QA, IT specialists. Unfortunately, too often the task of securing software falls to "breakers", such as pentesters and security researchers, who expose problems and push for improvements.
Widespread software weaknesses can be partially explained by the engineers' insufficient knowledge of secure software development. One of the most effective ways to improve it is to "gamify" the learning process. This will add rewards, healthy competition and stimulate the acquisition of practical skills.
Unfortunately "gamified" training is almost exclusively available to those on the "offensive" side. Security competitions, challenge sites, and hands-on security certifications all provide excellent opportunities for building practical attack security skills. There is a shortage of such opportunities for professionals on the "defensive" side.
In this talk, we will discuss this imbalance in greater depth and propose ways of making acquiring practical defensive security skills more effective.
We will also describe an open-source defence competition framework that we are releasing and share our experiences running defence-style competitions.
DETAILED OUTLINE
- Introduction
We start with a description of the general state of modern software quality and security, and its disappointing lack of improvement.
- Software vulnerability trends and causes
We will go through the statistics of software vulnerability volumes and trends. The multitude of underlying reasons for poor software security will be briefly discussed.
- Deficiencies in developer cybersecurity knowledge
We will discuss lack of comprehensive knowledge of secure software development among the "builder" community due to lack of education, blind spots in university programs and other reasons.
- Won't AI solve this?
We will talk about the role of AI helping defenders and the role of good education in spite of technology advancements.
- Red vs. blue focus
Defensive and offensive roles focus on very different objectives when it comes to software security - we will discuss the differences in priorities, prevention vs. mitigation, narrow vulnerability hunting vs. comprehensive security coverage, and others.
- Active learning in offensive security
Learning opportunities are tremendously unbalanced between the two groups, with vast majority of them favoring offensive security work.
Competition types
A significant number of security competitions (CTFs, Attack/Defence) are held online and as part of security conferences and corporate training, almost exclusively exercising offensive skills.
Challenge sites
Multitudes of challenge sites are available online, from crack-mes to commercial training sites like TryHackMme and HackTheBox, all of them also teaching red team skills.
Practical skill certifications
Professional certifications with the practical component are also primarily emphasizing "breaking" software.
Challenges of practical training for blue-teamers
Defenders are not usually trained on security
Defenders generally are not well trained on security topics - most develper training (including current university education) emphasizes algorithms, SDLC, software quality and testing, but not how to build secure software.
Offensive security training is not a good match for defenders
Available security training that we outlined above is not a good match for building secure software and is not interesting (and often intimidating) for defenders.
Defensive skills training is not effective or commonly available
Defensive security knowledge is mostly available through "book" knowledge, and by its nature very hard to teach and test effectively.
Gamified defensive training may be the best way to teach blue-team skills
We believe that specialized, "gamified" training could be the answer to this problem. Vulnerable software that has to be analyzed and fixed by defenders, with results verified through automated attacks will be a way to not only teach but also test the knowledge. It will help verify that the software security problems are understood by developers not only in a theoretical, but in a practical way.
Siege - open-source competition framework
We introduce an open source framework that teaches defensive security skills through competitive environment. Developers analyze software that is actively being exploited through a set of automated attacks, attempt to locate vulnerabilities and properly fix them.
System architecture and deployment
System architecture and setup is discussed.
Competition mechanics
We discuss the general competition flow and scoring.
Challenge varieties
We present different challenge types that are available. We also present a full competition mode, where you can have teams of players compete against each other, and a light mode where developers can analyze and fix software at their own pace.
Challenge development considerations
Building challenges with interesting security vulnerabilities requires both offensive and defensive expertise, and we will discuss general recommendations and best practices for creating a good training experience.
Conclusion
We conclude by reiterating the issues with lack of security knowledge of software builders and emphasize how they can be addressed through hands-on defensive training.
Dmitriy Beryoza is a Principal Security Researcher at Vectra AI. Before going into research, he was a penetration tester and secure software development advocate at IBM. He presented talks at SecTor, DEF CON Cloud Village, AtlSecCon, BSides LV/SF/Ottawa, HackFest, and other conferences. Dmitriy holds a Ph.D. in Computer Science and several industry certifications, including OSCP, GREM and CISSP. His interests include reverse engineering, secure software development, and CTF competitions.