Capture the flag (CTF) exercises and events continue to increase in popularity providing essential training and skills development for defenders on blue teams and attackers on red teams. Jeopardy style or attack-defense CTF cyber exercises enable experienced participants and novices to work side by side on teams developing communication, time management and problem solving skills in a safe environment with ground rules and prizes for winners. Defending blue teams often dread the embarrassment of being attacked and compromised until modern deception defenses arrived. Deception defenses mimic a real environment with decoys and breadcrumbs creating an unknown mine field for attackers to detect their activity and movements giving defending blue teams a new advantage.

1. Capturing the Flag with
Active Deception Defenses

2. © Fidelis Cybersecurity
Agenda
Introductions
Capture The Flag Cyber Games
Red vs Blue Teams
Opportunity for Deception
Capture the Flag Exercise with Deception
Results and Key Highlights
Lesson Learned
Chenxi Wang Ph.D
Managing General Partner
Rain Capital
Tom Clare
Product/Technical Marketing
Fidelis Cybersecurity
2

3. © Fidelis Cybersecurity3
Capture The Flag - A Cyber Game
What is Capture The Flag?
• A Security Puzzle
The Goal of a CTF?
• Find the flag embedded in the target
system w/in a set time window
• A file
• A secret
• A piece of information

4. © Fidelis Cybersecurity
Challenge-based CTF
You get to the goal by solving a series of
challenges
You get points for each challenge
Challenges:
● A vulnerability in application/protocol
● A weakness in crypto primitive or
implementation
● Reverse engineering a piece of code
● Write code to exploit a known flaw
4

5. © Fidelis Cybersecurity
Real-time Attack/Defense CTF
There are two opposing teams:
● Blue team defends the flag
● Red team tries to capture it
The flag is not an inanimate object!
It is much more challenging and fun!
5

6. © Fidelis Cybersecurity
Blue vs Red Teams
Blue Team focus includes:
Defending networks and systems
Monitoring security defenses
Security control effectiveness
Hardening systems and controls
Identifying security flaws
Incident response
Red Team focus includes:
White-hat hacker role as threat actors
Adversarial assessments (or pen-testing)
Real-world attack simulations w/o damage
Assess vulnerabilities to improve defenses
Effective against fixed procedures &
processes, plus strong cultures
Challenge preconceived notions
6

7. © Fidelis Cybersecurity
Why Do We Do CTF?
Because we don’t put drivers who only read the
driving handbook on the road
● Learn through hands-on exercises
● Learn to think like a hacker/attacker
● Learn problem solving skills
● Learn to collaborate in a team
● But ultimately - learn to protect our systems
And it’s fun! - it’s a game and a puzzle!
7

8. © Fidelis Cybersecurity
A Taste of CTF
Challenges:
• Forensics
• Crypto
• Reverse engineering
• Web exploitation
• Binary exploitation
Source: https://2017.picoctf.com/get_started
8

9. © Fidelis Cybersecurity
A Taste of CTF - “Pingpong 200”
There is a secret message from evil organization ZOR contained in two similar looking
image files. Find the message.
Solution: XOR the files, turn all pixels the same into white, all pixels not the same into black, and you
get: “sammyshoulddomorework” Source: https://jakobdegen.gitbooks.io/hsctf-4-writeups/content/
+
9

10. © Fidelis Cybersecurity
2016 and 2017 program
Room filled to the brim
2-hour training program
“This helped me to think outside the box”
“Computer security is more fun than I
thought”
“I wish my teacher did that in school!”
Grace Hopper Conference - CTF training
10

11. © Fidelis Cybersecurity
CTF Teaches Critical Thinking Skills
Most SOC analysts or threat hunters
require these skills
• Spot signs
• Understand scenarios and intentions
• Quickly decide on a course of action
• Respond to changes
11

12. © Fidelis Cybersecurity
CTF Competitions
Practice attack and defense techniques
Live sandboxed safe environment with
ground rules and prizes for winners
Discovery and exploitation of vulnerabilities
Points to secure and defend systems
Various security challenges for extra points
Teams with seasoned and new players in an
open safe and social environment
Develop communication, time management
and problem solving skills within teams
Professional development and an invaluable
experience
12

13. © Fidelis Cybersecurity
Cyber Warfare Exercises
Locked Shields – NATO Cooperative Cyber Defense Center of
Excellenceractice attack and defense techniques
Largest live-fire cyber defense exercise in the world
Over 550 people representing 26 nations
20 Blue Teams and NATO CIRC, many joint teams
Maintain networks and services of fictional country Berylia
Over 1700 possible attacks with over 1500 virtualized systems
Incidents, forensic challenges, legal, media and scenario injects
Servers, online services and industrial control systems
13

14. © Fidelis Cybersecurity14

15. © Fidelis Cybersecurity
Opportunity for Cyber Deception
Knowing what attackers desire creates
an opportunity for an active defense;
to lure, detect, and defend.
Global Average
Dwell Time
99 Days
Preventive
Defenses
Deception
Bait & Decoys
Attack
Lures
15

16. © Fidelis Cybersecurity
Deception Elements
16

17. © Fidelis Cybersecurity
Deception Alerts
17

18. © Fidelis Cybersecurity
End Goals for Deception
Research
Security Intelligence
Zero-Day Capture
Malware & Tools
Attribution/Mitigation
Increase Attack Surface
Detect & Defend
Post-Breach Visibility
Few False Positives
Automation/Scale
Enterprise-Wide Use
Low Risk/Friction
Highly Skilled
Security Researchers
Cyber Stakeout
Tier-1 Security Analysts
Accurate Alarm System
18

19. © Fidelis Cybersecurity
CTF Real Network
Real-world network complete with assets, users, services and data.
• 29 Users
• 1,491 Documents
• 5,532 Emails
• 31 Applications installed
• 3 Full browser profiles (Chrome, IE, FF)
• 2 Corporate web applications
• 2 Databases
• 1 Domain Controller (DC)
• 1 DNS Server
• 1 Private cloud service
19

20. © Fidelis Cybersecurity
CTF Deception Layer
The decoys were defined with a variation of
interactive capabilities.
• Some decoy services appeared only as open
ports, while others were full-blown services,
appearing to run real applications.
• Among the services made available were
TCP, UDP, SMB, HTTP, ICMP, RDP, FTP,
MYSQL, SMTP and SSH.
• 10 decoys
• 7 Workstations (user and development
machines running Windows 7)
• 2 Windows Servers (running Windows 2012
and Windows 2008)
• 1 Ubuntu Linux server
• 95 decoy services
Breadcrumbs or traps include:
• 61 files
• 39 beacon traps
• 27 emails
• 26 credentials
• 12 applications
• 10 IoT devices
• 2 network traps
Breadcrumbs make deception deterministic by
leading attackers to decoys, versus static
honeypots waiting to be found.
20

21. © Fidelis Cybersecurity
Example Traps
Email Trap
(unstructured data)
Chrome Browser Trap
(structured data)
21

22. © Fidelis Cybersecurity
CTF Deception Challenge
• CTF challenge to find 5 file hashes for information spread across assets
• Participants provided access to one asset via RAT (Remote Access Trojan)
• The first file hash containing key information resides on this infected asset
• Each subsequent file hash was technically harder to find requiring more expertise
• Each attacker or team worked solo on a fresh instance of the environment
• Tasks include gathering intelligence, collecting information, and moving laterally
• Public invitation to:
• Red teams
• Pen-testers
• Security researchers
• Best applicants selected
• Written mission brief & goals
• Challenge ran for 1+ month
• 52 participants w/global profile
• 6-7 hours of time/participant
• Dozen+ malware types also
tested in parallel
22

23. © Fidelis Cybersecurity
The Knowledge Gap
• Mission brief provided key
intel on first challenge
• Read the brief, averaged
~100 commands
• Did not read, used spray
and pray efforts
• Knowledge before and
during phases reduces
knowledge gap/commands
• Over time hackers become
quieter and harder to detect
• Early detection is critical
• Deception layers need to be
automatically kept current
and dynamic
23

24. © Fidelis Cybersecurity
Trap Consumption
(61)(27)(12) (26)(10) (2)(39)
Attacker Profiles
• 52 Humans
• 12 Malware
24

25. © Fidelis Cybersecurity
Traps: Man vs Machine
(61)(27)(12) (26)(10) (2)(39)
• Average human triggered
10.5 traps
• Humans target files, email
& unstructured data
• Malware targets apps and
structured data
• Passwords/credentials:
• Found 2 on average
• Utilized 2.5 times/avg
• Max reuse: 11 times
in 11 places
• Password traps near
decoys are very effective
• Trap variety is important
to cover attack types
25

26. © Fidelis Cybersecurity
Decoy Access
• On average, each attacker interacted
with nearly 10 decoy services
• No decoy had more than 47% activity,
signaling variety is important
• Sloppy attacks used scanners with
pings and SYNs, non-interactive noise,
easy for decoys to detect
• Sophisticated attacks were focused on
specific decoys with high interaction
• Decoy variety is important with live
services to engage attackers
26

27. © Fidelis Cybersecurity
CTF Deception Summary
Sophisticated attacks are more targeted and
highly interactive than careless and noisy low
interaction scanning
Deception needs to be diverse to be effective
against malware and human attackers
Deception layers should as realistic as possible,
kept current, and dynamic to increase the
knowledge gap against attackers
Augment deception layers with network and
traffic analysis for increased visibility and
accuracy
Deception lures, detects and consumes attacker
time, thus diverting and slowing attacks
27

28. © Fidelis Cybersecurity
Questions & Next Steps
In-depth Research White Paper
www.fidelissecurity.com/resources/applying-
deception-mechanisms-detecting-cyber-attacks
Case Study
www.fidelissecurity.com/case-study-first-midwest-
bank
Schedule a Demonstration
www.fidelissecurity.com/schedule-demo
28

29. Thank You!