The numbers of software vulnerabilities and misconfigurations keep growing year over year. Addressing them is most effective early in the process, by designing and building systems with security top of mind. This requires concerted efforts of "builders": software developers, QA, architects, and IT specialists. Unfortunately, too often the task of securing software falls to "breakers", such as pentesters and security researchers, who expose problems and push for improvements.
Widespread software weaknesses can be partially explained by the engineers' having insufficient understanding and knowledge of security issues. One of the most effective ways to improve this knowledge and skills is to "gamify" the learning process. This will add rewards, healthy competition and stimulate the acquisition of practical skills.
Unfortunately, over the years, "gamified" training has almost exclusively been available to those on the "offensive" security side. Security competitions, challenge sites, and hands-on security certifications all provide excellent opportunities for building practical attack security skills. There is a shortage of such opportunities for professionals on the "defensive" side.
In this talk, we will discuss this imbalance in greater depth and propose ways of making acquiring practical defensive security skills more effective.
We will also describe an open-source defence competition framework that we are releasing and share our experiences running defence-style competitions.
About the Presenter: Dmitriy Beryoza
Dmitriy Beryoza is a Principal Security Researcher at Vectra AI, working on threat detection in the cloud and on-prem networks. Before going into research, he was a penetration tester and secure software development advocate at IBM. Prior to switching to security full-time, Dmitriy was a software developer for many years. He presented talks at SecTor, DEF CON Cloud Village, AtlSecCon, BSides LV/SF/Ottawa, HackFest, and other conferences. Dmitriy holds a Ph.D. in Computer Science and several industry certifications, including OSCP, GREM and CISSP. His interests include reverse engineering, secure software development, and CTF competitions.
