Competitions and tournaments have been an important part of the cybersecurity field since DEF CON’s inaugural Capture the Flag (CTF) contest in 1996. Today these events attract an exceptional global community with top experts, motivated professionals, researchers, and students keen to demonstrate their technical mastery and creativity in a wide range of competitive/collaborative scenarios.

But can these “war games” really help with the cyber talent challenge? This article shares how competitive cybersecurity scenarios can benefit jobseekers and talent seekers alike.

Key takeaways

• Cyber war games include competitive, collaborative, and learning scenarios in a wide range of formats and venues.
• Cyber war games support the profession in many ways, including skill-building, community-building, and matching talent with job openings.
• Cyber war games can help participants build technical as well as leadership and communication skills while boosting confidence and interpersonal abilities.
• Major cyber competitions include DEF CON’s famous CTF games, the Pwn2Own contest with its enticing cash prizes, and US Cyber Challenge (USCC) events specifically developed to attract and develop new cyber professionals.

What are cyber war games?

Cyber war games are competitive, learning, and collaborative scenarios often designed to simulate real-world incidents like a cyber-attack or system crash. The goal is often to solve a difficult problem to earn points, where time is frequently of the essence.

There is wide diversity in war game formats. These are the most popular types:

• Capture the Flag (CTF) competitions, where the goal is to find hidden text strings (“flags”) associated with system vulnerabilities. These can be held online or in person. The harder the challenge, the more points the solution is worth.
• Attack-Defense scenarios, where teams defend their own environment or network while attacking one or more environments defended by others—all of which include built-in vulnerabilities. Many CTF competitions use this format.
• Jeopardy-style challenges, where teams or individuals solve an assortment of cyber problems in different areas (e.g., cryptography, web applications, incident forensics). CTF competitions often use this format.
• Network defense, where the goal is to protect and manage a live network against simulated attacks. The National Collegiate Cyber Defense Competition (CCDC) is a well-known example of this competition format.
• Scenario-based, where participants tackle interactive challenges in highly realistic situations that may even be industry specific.
• Vulnerability and exploit contests (e.g., Pwn2Own) where participants try to find vulnerabilities in commercial software or hardware.
• Events focused on a specific skill set, such as physical hacks on IoT hardware or reverse-engineering software.

8 ways cyber war games help the professional community

Hiring and keeping cybersecurity talent is a perennial challenge. Cybersecurity professionals often need a wide range of skills in diverse areas like cloud infrastructure, network management, incident response, threat hunting, web application security, privacy, compliance, and so on. Finding candidates that have the right breadth and depth of expertise for a specific position can be time-consuming, leaving key roles unfilled. Plus, cybersecurity evolves rapidly as new attacks, tools, and controls/frameworks wax and wane in importance, adding to the potential “laundry list” of requirements in a job description.

Here are eight ways that war games support the cyber community to build skills and match professionals with job roles:

1. War games provide a venue for continuous learning for people at all expertise levels, from students up to top experts.
2. War games can be an ideal way for participants to connect their theoretical or classroom understandings to hands-on experience.
3. War games help professionals stay current with evolving cyber-attack and defense trends, recent threat intelligence, new technology, etc.
4. War games build community within the cybersecurity profession (think networking and referrals).
5. War games help identify industry talent and help professionals showcase their talent.
6. War games help professionals develop practical, marketable skills and confidence as well as promote teamwork.
7. War games offer a venue for organizations and talent professionals to find and recruit skilled talent.
8. War games can demonstrate real-world problem-solving, strategic thinking, collaboration, leadership and creative skills that might not come out in conventional job interviews.

By providing a realistic and/or challenging environment where skills (not to mention daring) are needed to solve difficult problems, cyber war games help enhance, assess, and recognize cyber talent.

What skills can cyber war games help professionals develop?

War games often simulate real-life attack scenarios and adversaries, or pit participants against real-world challenges. These situations let participants practice, build, and refine critical proficiencies in a safe environment—without the pressure and risk of a live incident happening on production infrastructure where downtime can cost thousands of dollars per hour.

Organizations that leverage war games formats to train cyber professionals can elevate their cybersecurity posture, improve their real-world incident response capabilities, and increase job satisfaction for key people they want to retain.

Some of the capabilities that cyber war games can help organizations and individuals develop include:

• Technical skills around penetration testing, vulnerability assessment, incident response, threat hunting, and learning new tools and techniques.
• Teamwork and collaboration skills, such as communication and interpersonal skills.
• Problem-solving, decision-making, and leadership skills that build experience and confidence around making high-pressure choices in real-time—critical abilities during a cyber-attack or other crisis.

Because war games are engaging, fun, and safe, they can help build skills and reduce a company’s cyber skills deficits. War games type training can benefit not just technical experts and cyber/IT professionals, but also non-technical staff whose roles involve cybersecurity or cyber compliance.

What are some of the top cyber war games competitive and learning venues?

Some of the best-known cyber war game competitions among many include:

• DEF CON’s influential CTF competitions.
• Pwn2Own, organized by Trend Micro and the Zero Day Initiative, where participants try to find and exploit vulnerabilities in commercial software to win large cash prizes.
• The President’s Cup Cybersecurity Competition (PCCC), which seeks to identify and incentivize top cyber professionals from the U.S. government workforce.
• The National Collegiate Cyber Defense Competition (NCCDC)—the biggest US college cyber competition, in which qualifying teams of students who have advanced through regional events defend a simulated corporate network infrastructure against a live cyberattack.
• Plaid CTF, Carnegie Mellon University’s annual CTF competition famous for its exceptionally challenging scenarios, which is open to all.
• PicoCTF: A free, online computer security game and competition for middle and high school students. Created by Carnegie Mellon University, it is currently the world’s largest free hacking competition, with worldwide participation.
• The US Cyber Challenge (USCC), a program run by the nonprofit Center for Internet Security (CIS) featuring week-long camps with competitions designed to attract, recruit, and place new cybersecurity professionals in the US workforce.

What’s next?

For more guidance on this topic, listen to Episode 155 of The Virtual CISO Podcast with guest Matt Lea, Founder at Schematical.com.