Risk

11/9/2018
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Inside CSAW, a Massive Student-Led Cybersecurity Competition

Nearly 400 high school, undergraduate, and graduate students advance to the final round of New York University's CSAW games.

CSAW – Brooklyn, New York – New York University's CSAW, which calls itself the world's largest student-run cybersecurity competition, this week announced the 397 high school, undergraduate, and graduate students from around the world who will enter its final round.

CSAW started in, and is organized by, NYU's Tandon School of Engineering. This year, its 15th running, saw 3,500 teams from more than 100 countries enter the games. The remaining contenders will now travel to academic sites across four continents to compete in the finals.

The competition was founded in 2003 as a small local event by Nasir Memon, an NYU professor of computer science and engineering. It has since expanded to include eight global events, all of which evolve to host challenges and contests that align with the changing threat landscape.

"It started accidentally, like many things start," said Memon in an interview with Dark Reading at the North American branch of the CSAW finals. The event is taking place this week on NYU Tandon's campus in Brooklyn, New York.

CSAW's first participants, all Tandon students, were challenged with cleaning up poorly configured laptops among other adversarial tasks designed to test their offensive and defensive security skills. The internal competition quickly expanded — first to local New York universities, then throughout the tri-state area, and now in Mexico, Israel, and around the world.

"What we really caught on to was, there's a kind of talent that likes these adversarial challenges," Memon explained. "You cannot really teach security by lecturing in a classroom. You have to understand how attackers work."

The first stage of CSAW happens online. When competitors reach the finals, they're brought together so they can get to know each other. "In order to protect … you need to be sharing information with each other," he said. "Otherwise, the bad guys have an advantage."

Challenges are designed with the help of New York City's top white-hat hackers. Players of all ages and levels can join Capture the Flag, the flagship CSAW event that tests hacking and defensive skills. An embedded security challenge, which CSAW calls its most difficult event, pits red teams against blue teams in simulated cyberattacks. This year's, created with the United States Office of Naval Research, requires participants to perform data exfiltration attacks against Internet of Things devices.

Different challenges attract students of different levels and expertise. A Policy Challenge attracts students in policy and law school who are interested in how security will play a role. Applied Research accepts peer-reviewed security papers that have been published in scholarly journals. A forensics analysis competition is restricted to high school students, he explained.

Memon said CSAW has proven an effective way to attract students to cybersecurity, a concept he said wasn't yet in people's minds when the competition started 15 years ago. Studies show after competing, students often decide to pursue cybersecurity careers, he pointed out. If they don't, they have greater security awareness as software engineers or other non-infosec roles.

The event has become a hot spot for recruiters, who CSAW initially brought in to help offset the cost of transportation and accommodations for students who fly in for the finals. "We're not doing this to make money," Memon said, noting all the workers are volunteers. But flights and hotels for a growing pool of student competitors can get expensive.

Companies "across the board" come to CSAW to recruit security employees, he said, with the majority representing the tech and financial sectors. A growing number of businesses are expressing interest in attending the event to seek out talent.

Related Content:

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.