March March 29, 2005 DCE Panel Members Dr. Drew Hamilton, Auburn University Rick Toliver, Teledyne Solutions Inc. Joe Popinski, Information Engineering Southeastern Software Engineering Conference 2005

March 20052

3 Committee and Judges Judges Dr. Drew Hamilton, Auburn University Dr. John Wu, Auburn University Don Reifer, Refier Consulting, Inc. DCE Committee Paul DePriest, IE Joe Popinski, IE Don Reifer, RCI Jason Bradford, RSA Rick Toliver, TSI SA Hale, TSI Eadie Warboys, TBE Del Hart, UAH Drew Hamilton, AU John Wu, AU Matt Pierce, Adtran Chris Stanford, TSI Lisa Rich, ASU George Starcher, Cinram

March DCE Overview Goal – Run a realistic exercise to educate the community on: –Best practices –Vulnerabilities –Technology Operational Scenario –Teams will be provided access to the network –Teams will not be supervised –Judges will roam once the exercise is underway –Teams will be scored –The team with the most points will be declared the “WINNER” Ground Rules Do not launch a Denial of Service attack Do not ARP-cache-poison our servers Do not install kernel level root kits on targets Do not connect to an external network (wired or wireless) Once you gain access, do not close the security hole Do not change passwords Do not attack your competitor’s machines No internet connectivity or tools will be provided No physical access to the target machines will be provided

March Scoring Guidelines GoalMax. points Map the target network by IP address, Operating System, and identify network services provided. 10 Add a Web page to Web Server in DMZ. Add link form existing home page.5 Add entry to the DNS tables and make new entries active5 Identify all user accounts on each machine1 per acct Identify all user passwords on each machine1 per password Identify Firewall configuration5 Obtain root shell on a target machine3 per machine* Create an account on a target machine3 per machine* Install “backdoor” software on target machine. Software must operate properly.5 per machine Find and identify the “Special Device” on the network20 Obtain “Golden” file from each target machineInstant Prize

March What it takes Equipment usage from sponsoring companies Volunteer time, hundreds of hours Planning well in advance Coordination with SE2 DCE Publicity with community Dedication by all involved Special Thanks to Cisco, Green Hills Software and Arxceo

March The Target System This was not your father’s network –Multiple networks –Layered defense Router/switch External web server DMZ Firewall Servers (Linux & Win) Golden Files Special Device (2) –Password protection –VLANs

March The Network

March Team #1 - Raiders of the Lost Arc – UAH Brooks Mattox, Roy Cole Team #2 – Athens State Combat Team Paul Koon, David Fitsimmons, Miroslav Sadilek Team # 3 – Auburn Orange Kevin Richard, Alan Hunt, Adam Hathcock, Daniel Kolenich Team #4 – Auburn Blue Will Fletcher, Dave Baxter, Bill Cleveland, Daniel Box The Participants

March Results Summary All day session The defensive team was in charge of the target network –Spent a lot of time and effort configuring, building and testing the system All of the participants: –Worked hard –Achieved the goals of the exercise –Learned a lot from each other –Had fun The results were: –Raiders of Lost Arc, first –Auburn Blue, second –Auburn Orange, third –Athens State, fourth Thanks go to many vendors for use of their equipment

March Winning Team with Judges

March Many Thanks Supporting Companies Judges –Dr. Drew Hamilton, Auburn University –Dr. John Wu, Auburn University –Don Reifer, RCI Participants

March Five Questions 1.What was learned about network vulnerabilities? If so, what vulnerabilities? 2.What did we learn about network protection technology and techniques? If so, what technologies and techniques were most applicable? 3.Did the DCE motivate us to shore up network security practices? If so, in what areas should effort be expended (intrusion detection, firewalls, etc.)?

March Panel Questions? 4.What lessons did we learn relative to conducting another DCE at next year’s conference? 5.What can we do to make the exercise more exciting next year (put up $, invite professionals, etc.)?

March Conclusions Hopefully, the exercise served to demonstrate that expertise in network security is needed by both government and private industry! Perhaps there are things that we can learn from the exercise Maybe, it’s time to embrace new ideas